1 |
Hello all, I just finished installing hardened gentoo on an i686 dual |
2 |
p3 system and have some questions. I used the 2006.1 install CD and |
3 |
the stage3-hardened-2007.0 tarball. After configuring the kernel and |
4 |
recompiling the toolchain (binutils, gcc, virtual/libc) I did an |
5 |
'emerge -e world'. This is my first hardened profile install but I |
6 |
have used the grsec patches on a kernel before (an amd64 system) and |
7 |
after rebuilding the toolchain then userland paxtest was killed on all |
8 |
but one or two types of stack execution. |
9 |
|
10 |
However, this time (on the dual p3 system) paxtest is still able to do a lot.... |
11 |
|
12 |
Altador ~ # paxtest blackhat |
13 |
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@×××××××××.org> |
14 |
Released under the GNU Public Licence version 2 or later |
15 |
|
16 |
Writing output to paxtest.log |
17 |
It may take a while for the tests to complete |
18 |
Test results: |
19 |
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@×××××××××.org> |
20 |
Released under the GNU Public Licence version 2 or later |
21 |
|
22 |
Mode: blackhat |
23 |
Linux Altador.hackdmz.net 2.6.21-hardened-r1-allknowing #4 SMP Fri May |
24 |
18 21:17:29 MDT 2007 i686 Pentium III (Coppermine) GenuineIntel |
25 |
GNU/Linux |
26 |
|
27 |
Executable anonymous mapping : Vulnerable |
28 |
Executable bss : Vulnerable |
29 |
Executable data : Vulnerable |
30 |
Executable heap : Vulnerable |
31 |
Executable stack : Vulnerable |
32 |
Executable anonymous mapping (mprotect) : Vulnerable |
33 |
Executable bss (mprotect) : Vulnerable |
34 |
Executable data (mprotect) : Vulnerable |
35 |
Executable heap (mprotect) : Vulnerable |
36 |
Executable stack (mprotect) : Vulnerable |
37 |
Executable shared library bss (mprotect) : Vulnerable |
38 |
Executable shared library data (mprotect): Vulnerable |
39 |
Writable text segments : Vulnerable |
40 |
Anonymous mapping randomisation test : 18 bits (guessed) |
41 |
Heap randomisation test (ET_EXEC) : 13 bits (guessed) |
42 |
Heap randomisation test (ET_DYN) : 23 bits (guessed) |
43 |
Main executable randomisation (ET_EXEC) : No randomisation |
44 |
Main executable randomisation (ET_DYN) : 15 bits (guessed) |
45 |
Shared library randomisation test : 18 bits (guessed) |
46 |
Stack randomisation test (SEGMEXEC) : 24 bits (guessed) |
47 |
Stack randomisation test (PAGEEXEC) : 24 bits (guessed) |
48 |
Return to function (strcpy) : paxtest: bad luck, try |
49 |
different compiler options. |
50 |
Return to function (memcpy) : Vulnerable |
51 |
Return to function (strcpy, RANDEXEC) : paxtest: bad luck, try |
52 |
different compiler options. |
53 |
Return to function (memcpy, RANDEXEC) : Vulnerable |
54 |
Executable shared library bss : Killed |
55 |
Executable shared library data : Killed |
56 |
|
57 |
|
58 |
Is this expected? Did I skip a step? Here is my kernel config. |
59 |
|
60 |
# |
61 |
# Security options |
62 |
# |
63 |
|
64 |
# |
65 |
# Grsecurity |
66 |
# |
67 |
CONFIG_GRKERNSEC=y |
68 |
# CONFIG_GRKERNSEC_LOW is not set |
69 |
# CONFIG_GRKERNSEC_MEDIUM is not set |
70 |
# CONFIG_GRKERNSEC_HIGH is not set |
71 |
CONFIG_GRKERNSEC_CUSTOM=y |
72 |
|
73 |
# |
74 |
# Address Space Protection |
75 |
# |
76 |
CONFIG_GRKERNSEC_KMEM=y |
77 |
CONFIG_GRKERNSEC_IO=y |
78 |
CONFIG_GRKERNSEC_PROC_MEMMAP=y |
79 |
CONFIG_GRKERNSEC_BRUTE=y |
80 |
CONFIG_GRKERNSEC_MODSTOP=y |
81 |
CONFIG_GRKERNSEC_HIDESYM=y |
82 |
|
83 |
# |
84 |
# Role Based Access Control Options |
85 |
# |
86 |
CONFIG_GRKERNSEC_ACL_HIDEKERN=y |
87 |
CONFIG_GRKERNSEC_ACL_MAXTRIES=3 |
88 |
CONFIG_GRKERNSEC_ACL_TIMEOUT=30 |
89 |
|
90 |
# |
91 |
# Filesystem Protections |
92 |
# |
93 |
CONFIG_GRKERNSEC_PROC=y |
94 |
CONFIG_GRKERNSEC_PROC_USER=y |
95 |
CONFIG_GRKERNSEC_PROC_ADD=y |
96 |
CONFIG_GRKERNSEC_LINK=y |
97 |
CONFIG_GRKERNSEC_FIFO=y |
98 |
CONFIG_GRKERNSEC_CHROOT=y |
99 |
CONFIG_GRKERNSEC_CHROOT_MOUNT=y |
100 |
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y |
101 |
CONFIG_GRKERNSEC_CHROOT_PIVOT=y |
102 |
CONFIG_GRKERNSEC_CHROOT_CHDIR=y |
103 |
CONFIG_GRKERNSEC_CHROOT_CHMOD=y |
104 |
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y |
105 |
CONFIG_GRKERNSEC_CHROOT_MKNOD=y |
106 |
CONFIG_GRKERNSEC_CHROOT_SHMAT=y |
107 |
CONFIG_GRKERNSEC_CHROOT_UNIX=y |
108 |
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y |
109 |
CONFIG_GRKERNSEC_CHROOT_NICE=y |
110 |
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y |
111 |
CONFIG_GRKERNSEC_CHROOT_CAPS=y |
112 |
|
113 |
# |
114 |
# Kernel Auditing |
115 |
# |
116 |
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set |
117 |
CONFIG_GRKERNSEC_EXECLOG=y |
118 |
CONFIG_GRKERNSEC_RESLOG=y |
119 |
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y |
120 |
# CONFIG_GRKERNSEC_AUDIT_CHDIR is not set |
121 |
# CONFIG_GRKERNSEC_AUDIT_MOUNT is not set |
122 |
# CONFIG_GRKERNSEC_AUDIT_IPC is not set |
123 |
# CONFIG_GRKERNSEC_SIGNAL is not set |
124 |
# CONFIG_GRKERNSEC_FORKFAIL is not set |
125 |
# CONFIG_GRKERNSEC_TIME is not set |
126 |
CONFIG_GRKERNSEC_PROC_IPADDR=y |
127 |
|
128 |
# |
129 |
# Executable Protections |
130 |
# |
131 |
CONFIG_GRKERNSEC_EXECVE=y |
132 |
CONFIG_GRKERNSEC_SHM=y |
133 |
CONFIG_GRKERNSEC_DMESG=y |
134 |
CONFIG_GRKERNSEC_TPE=y |
135 |
CONFIG_GRKERNSEC_TPE_ALL=y |
136 |
# CONFIG_GRKERNSEC_TPE_INVERT is not set |
137 |
CONFIG_GRKERNSEC_TPE_GID=1337 |
138 |
|
139 |
# |
140 |
# Network Protections |
141 |
# |
142 |
CONFIG_GRKERNSEC_RANDNET=y |
143 |
CONFIG_GRKERNSEC_SOCKET=y |
144 |
# CONFIG_GRKERNSEC_SOCKET_ALL is not set |
145 |
# CONFIG_GRKERNSEC_SOCKET_CLIENT is not set |
146 |
CONFIG_GRKERNSEC_SOCKET_SERVER=y |
147 |
CONFIG_GRKERNSEC_SOCKET_SERVER_GID=1337 |
148 |
|
149 |
# |
150 |
# Sysctl support |
151 |
# |
152 |
CONFIG_GRKERNSEC_SYSCTL=y |
153 |
CONFIG_GRKERNSEC_SYSCTL_ON=y |
154 |
|
155 |
# |
156 |
# Logging Options |
157 |
# |
158 |
CONFIG_GRKERNSEC_FLOODTIME=10 |
159 |
CONFIG_GRKERNSEC_FLOODBURST=4 |
160 |
|
161 |
# |
162 |
# PaX |
163 |
# |
164 |
CONFIG_PAX=y |
165 |
|
166 |
# |
167 |
# PaX Control |
168 |
# |
169 |
# CONFIG_PAX_SOFTMODE is not set |
170 |
CONFIG_PAX_EI_PAX=y |
171 |
CONFIG_PAX_PT_PAX_FLAGS=y |
172 |
# CONFIG_PAX_NO_ACL_FLAGS is not set |
173 |
CONFIG_PAX_HAVE_ACL_FLAGS=y |
174 |
# CONFIG_PAX_HOOK_ACL_FLAGS is not set |
175 |
|
176 |
# |
177 |
# Non-executable pages |
178 |
# |
179 |
CONFIG_PAX_NOEXEC=y |
180 |
|
181 |
# |
182 |
# Address Space Layout Randomization |
183 |
# |
184 |
CONFIG_PAX_ASLR=y |
185 |
CONFIG_PAX_RANDKSTACK=y |
186 |
CONFIG_PAX_RANDUSTACK=y |
187 |
CONFIG_PAX_RANDMMAP=y |
188 |
|
189 |
# |
190 |
# Miscellaneous hardening features |
191 |
# |
192 |
CONFIG_PAX_MEMORY_SANITIZE=y |
193 |
# CONFIG_KEYS is not set |
194 |
CONFIG_SECURITY=y |
195 |
# CONFIG_SECURITY_NETWORK is not set |
196 |
CONFIG_SECURITY_CAPABILITIES=y |
197 |
# CONFIG_SECURITY_ROOTPLUG is not set |
198 |
|
199 |
-- |
200 |
Matthew Poletiek |
201 |
www.chill-fu.net |
202 |
-- |
203 |
gentoo-hardened@g.o mailing list |