| 1 |
If I paxctl -PS the ioquake3 binary it crashes on startup with the error: |
| 2 |
|
| 3 |
PAX: execution attempt in: /dev/zero |
| 4 |
|
| 5 |
logged to the syslog. If I paxctl -ps ioquake3 it runs fine. Of course |
| 6 |
mprotect is disabled in both cases. Quake3 is really only an example though. |
| 7 |
I guess my larger question is: |
| 8 |
|
| 9 |
If I use the SSP-enabled toolchain, I'll loose my ability to toggle this |
| 10 |
protection off and on at will right? Am I correct that the only work arounds |
| 11 |
in this case would involve some kind of recompiling with per-package flags, |
| 12 |
etc.? |
| 13 |
|
| 14 |
Thank you for your help. |
| 15 |
|
| 16 |
On Saturday, January 27, 2007 18:59, John Schember wrote: |
| 17 |
> SSP is stack smashing protection. Unless an application your using for |
| 18 |
> some strange reason likes to over run the stack and execute code just |
| 19 |
> like a buffer overrun attack you won't have a problem. As far as Quake3 |
| 20 |
> goes you won't have a problem with the hardened tool chain. |
| 21 |
> |
| 22 |
> John Schember |
| 23 |
> |
| 24 |
> |
| 25 |
> On Sat, 2007-01-27 at 18:20 -0800, gentoo-hardened-ml-01@××××××.org |
| 26 |
> |
| 27 |
> wrote: |
| 28 |
> > I've had a "partially-hardened" workstation for awhile now. I use |
| 29 |
> > hardened-sources and enable many of the PaX/grsecurity options including |
| 30 |
> > stack smashing protection. This works great as I can disable SEGMEXEC, |
| 31 |
> > PAGEEXEC and mprotect for Quake3 (ioquake3) and get it to run. My |
| 32 |
> > question is if I take my workstation to a full hardened system with |
| 33 |
> > SSP+PIE toolchain, etc. will I still be able to run Quake3 and other |
| 34 |
> > programs like it? If I went to a full Hardened Gentoo system, even if I |
| 35 |
> > disabled PaX's SEGMEXEC, PAGEXEC and mprotect, which is sufficient to run |
| 36 |
> > Quake3 now, the toolchains' own SSP would then kick in and stop me, |
| 37 |
> > right? |
| 38 |
> > |
| 39 |
> > I'm normally a test and do-it-myself kind of person, but I really don't |
| 40 |
> > want to have to recompile the system to find out and then recompile again |
| 41 |
> > if gcc's SSP/ProPolice does stop me. |
| 42 |
> > |
| 43 |
> > Side note: I masked gcc-4* and >=glibc-2.4 when they were stabled in x86. |
| 44 |
> > I still run gcc-3.4.6-r2 and glibc-2.3.6-r5 so switching to the hardened |
| 45 |
> > profile will not present any of those types of problems for me. |
| 46 |
> > |
| 47 |
> > Thank you for your help. |
| 48 |
-- |
| 49 |
gentoo-hardened@g.o mailing list |
Archives