Re: [gentoo-hardened] Running Skype on Hardened

[Ђорђе Тодоровић]

On Thu, 29 Mar 2012, Sven Vermeulen wrote:

>You can try to make it a valid ELF header first, and then paxmark it.
>
>I have the following for my Skype:
>paxctl -C /opt/skype/skype
>paxctl -me /opt/skype/skype

I tried running paxctl -Cm on it (should be ran on install with pax_kernel USE
flag), by it still reports an invalid ELF executable.

This is listed in the ebuld:

if use pax_kernel; then
     pax-mark Cm "${D}"/opt/skype/skype || die
     eqawarn "You have set USE=pax_kernel meaning that you intend to run"
     eqawarn "skype under a PaX enabled kernel.  To do so, we must modify"
     eqawarn "the skype binary itself and this *may* lead to breakage!  If"
     eqawarn "you suspect that skype is being broken by this modification,"
     eqawarn "please open a bug."
fi

BTW,I checked the skype changelog and this was added recently:
     29 Feb 2012; mthode <mthode@g.o> skype-2.2.0.35-r1.ebuild:
     fix the paxmarking syntax
     
     28 Feb 2012; mthode <mthode@g.o> skype-2.2.0.35-r1.ebuild:
     paxmarked m skype to work on hardened


But it somehow fails to complete on my machine when I try it manually.
I also just checked, my current profile is multilib (I said earlier no-mulitlib)

I seriously am not sure if it is of any help,but attached the ELF header of the
skype executable (/opt/skype/skype) so maybe (IDK) someone can tell if
there is an obvious problem there. 

file /opt/skype/skype says:
/opt/skype/skype: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped


-- 
  . O . | Djordje Todorovic    [http://barabbas.github.com] | O . O
  . . O | GPG-Key: 2048R/1E133339      (http://pgp.mit.edu) | . O O
  O O O | BFF2 1C7F A70D ECCD FA8F C946 DB32 B498 1E13 3339 | . O .