Re: [gentoo-hardened] PaX and the availability of the NX bit on a CPU

[Pedro Venda]

On Friday 09 June 2006 19:51, pageexec@××××××××.hu wrote:
> On 9 Jun 2006 at 17:56, Pedro Venda wrote:
> > I'm installing a new server with the hardened profile, a PaX enabled
> > kernel (PAGEEXEC) and a little of grsecurity. The cpu is a recent intel
> > celeron with NX bit and 64bit extensions (whatever that means).
> >
> > I was wondering if the PAGEEXEC feature of PaX is able to detect and
> > transparently use the NX bit or if it's enabled for some particular
> > architectures only...
>
> if you use a 64 bit kernel (ARCH=x86_64) then PaX will make use of the
> hardware NX bit as vanilla itself already uses it (with some cleanup i
> added in PaX). note that this holds for both 64 bit and 32 bit userland.
>
> if you want a 32 bit kernel then as of now PaX would NOT use the NX bit,
> you're stuck with PAGEEXEC (the supervisor bit based method) or SEGMEXEC.
> the reason for this is that when NX was introduced, it was part of amd64
> therefore i didn't see much point in adding support for a 32 bit kernel,
> people buy a 64 bit CPU to run 64 bit kernels on it. unfortunately, intel
> in its infinite wisdom began to add NX support to their CPUs without the
> 64 bit extensions, so ever since supporting them has been on my todo list,
> just no time/motivation to get it done.

ok, seems reasonable.

>
> > I've compiled the kernel for pentium3 and built the system
> > with -march=pentium3.
>
> that doesn't affect NX use, only the generated code, and you should check
> your cpu family before deciding which CPU arch to use.

About the architecture, I didn't think about it much because I assumed it was 
like a centrino (don't know why) but then again, I'm not sure the celeron is 
netburst. I'll check it out

Thanks for the information.

Best regards,
-- 

Pedro João Lopes Venda
email: pjvenda at pjvenda org
http://www.pjvenda.org