Re: [gentoo-hardened] Success with 2.6.4-hardened

> Here's some information regarding the applications I had to fix.
> Most of the problems are related to the fact that the binaries
> are not linked statically (which would presumably fix most problems).
> Most of them don't generate logs, but I hope the information
> I provided will be usefull anyway.

thanks for the info, my comments follow inlined (i'm CC'ing the list
as there's some work to do ;-):

> ntpd:
> - --------
>
> [markus@biohazard] /sbin/chpax -v /usr/bin/ntpd
>
> - ----[ chpax 0.6.1 : Current flags for /usr/bin/ntpd (PeMRxs) ]----
>
> [markus@biohazard] sudo /usr/bin/ntpd
> /usr/bin/ntpd: error while loading shared libraries: /lib/libcap.so.1:
> cannot make segment writable for relocation: Permission denied
>
> FIXED VIA
>
> [markus@biohazard] sudo /sbin/chpax -peMRxs /usr/bin/ntpd

the 'cannot make segment writable...' message means that the
given library has text relocations in it, that should be
gotten rid of instead of disabling MPROTECT (actually, you
were disabling more than that, SEGMEXEC itself). also static
compilation won't solve the problem when using PIEs (whenever
that becomes possible at all, that is), it'd just make the
main executable non-relocatable.

> acroread:
> - ---------------
>
> The following works fine
>
> [markus@biohazard] /sbin/chpax -v
> /opt/Acrobat5/Reader/intellinux/bin/acroread
>
> - ----[ chpax 0.6.1 : Current flags for
> /opt/Acrobat5/Reader/intellinux/bin/acroread (pEmRxs) ]----
>
> using "PEmRxs" also works but the binary loads very slowly; likely some
> trouble loading the plugins.

i guess the slowdown is due to using PAGEEXEC (and you probably
have a P4). i take it that acroread has a gcc nested function
trampoline and hence EMUTRAMP fixed it, in that case chpax -E
is enough, i.e., you can keep SEGMEXEC, it should be back to
its normal speed then.

> mplayer/xine:
> - ---------------------
>
> Both require
>
> [markus@biohazard] /sbin/chpax -v /usr/bin/mplayer
>
> - ----[ chpax 0.6.1 : Current flags for /usr/bin/mplayer (PemRxs) ]----
>
> PeMRxs causes failure to load shared libraries

same comments as for ntpd, although i guess fixing all these asm
optimized libraries will take some coding (if at all possible
without losing too much performance).

> soffice
> - -----------
>
> The following works,
>
> [markus@biohazard] /sbin/chpax -v
> /opt/Ximian-OpenOffice/program/soffice.bin
>
> - ----[ chpax 0.6.1 : Current flags for
> /opt/Ximian-OpenOffice/program/soffice.bin (pemRxS) ]----
>
> enabling everything else causes either libraries to fail loading or the
> binary gets killed.

the library issue is discussed above, as for the kills i guess
that openoffice generates code at runtime (properly this time)
and hence MPROTECT has to be disabled - fair enough.

> wvdial
> - ----------
>
> The following works
>
>
> [markus@biohazard] /sbin/chpax -v /usr/bin/wvdial
>
> - ----[ chpax 0.6.1 : Current flags for /usr/bin/wvdial (PemRxs) ]----
>
> PeMRxs causes failure to load shared libraries.

again, discussed above, for now disable MPROTECT and post the
library names that have text relocations.


--
gentoo-hardened@g.o mailing list