Re: [gentoo-hardened] NX bit on VIA C7

[Philipp Riegger]

On 02.05.2007, at 22:36, Philipp Riegger wrote:

> I'm not sure wich tests you mean. I'll post the complete log of the
> test with hardened sources and the differences between the tests as
> soon as i finish them.

Ok. This is strange now. everything seems to work:

May  2 19:29:53 chris NX (Execute Disable) protection: active
May  2 19:58:20 chris NX (Execute Disable) protection: active

This are the 2 kernels i booted today. And since i only booted 2  
kernels today, 1 hardened and 1 vanilla, hardware nx shoul hopefully  
work now. The paxtest results were also as expected, not hardened was  
only more vulnerable.

But:

I found this demo program on the bug mentioned in my first email (in  
the link):

<file name="test.c">
#include <dlfcn.h>
#include <sys/mman.h>
#include <unistd.h>

int main() {
         void (*test_func)() = NULL;
         void *handle;
         handle = dlopen("./test_so.so", RTLD_NOW);
         if (!handle)
                 return -1;
         test_func = dlsym(handle, "prot_test");
         test_func();

         /*Mprotect it NX*/
         mprotect( (void*)(((unsigned long)test_func) & ~(getpagesize 
() - 1)), ge
tpagesize(), PROT_READ|PROT_WRITE);

         test_func();
         return 1;
}
</file>
<file name="test_so.c">
#include <stdio.h>

void prot_test() {
         printf("Test function run successfully!\n");
}
</file>

This should be built using
          gcc -O2 -shared -fpic test_so.c -o test_so.so
          gcc -O2 test.c -o test -ldl
and on vanilla sources the second one segfaults for me, on hardened  
sources it works. So hardened sources seem to be wrong. What might be  
the reason for that?

Philipp
-- 
gentoo-hardened@g.o mailing list