Enable PAGEEXEC as default? (WAS: Re: [gentoo-hardened] Grsecurity slows down a web server?)

[David Sommerseth]

René Rhéaume wrote:
> On Fri, Jan 23, 2009 at 11:45 AM, Grant <emailgrant@×××××.com> wrote:
>> Very close.  PAGEEXEC is enabled, but so is SEGMEXEC.  My CPU is a
>> P4-2.8, and I'm not sure about NX support but these are the flags:
>>
>> fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36
>> clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe constant_tsc pebs bts
>> pni monitor ds_cpl cid xtpr
>
> There is no "nx" in your cpuinfo flags. Therefore, your P4 does not
> have the hardware NX bit (or XD bit in Intel wording)

Hi all!

I've been following this discussion a little bit.  I do have a Pentium D
processor which do have the "nx" flag available.

I see I do have CONFIG_PAX_PAGEEXEC=y in the kernel config, but I do also
see that all non-kernel processes do have peMRS in the PAX flags when
checking with the pspax command.

Should I strive to get the PAGEEXEC flag set on all processes, or should I
not?

Another thing ... I do not quite understand why processes are listed with
peMRS when paxctl says something a little bit different.  An example:

pspax:
root     11864  peMRS  w^x  ET_EXEC    openvpn          =ep cap_setpcap-ep

paxctl -v /usr/sbin/openvpn:
- PaX flags: -------x-e-- [/usr/sbin/openvpn]
	RANDEXEC is disabled
	EMUTRAMP is disabled

I've scanned through the whole system with "qlist -ao|scanelf -f - -q -x"
and can't say I find anything here which is of concern, it only finds
those paxtest files in /usr/lib/paxtest ... so everything should be
default on the file level.

I was of that understanding that my current setup would give PAGEEXEC as
default.


kind regards,

David Sommerseth