Re: [gentoo-hardened] PaX and the availability of the NX bit on a CPU

On 9 Jun 2006 at 17:56, Pedro Venda wrote:
> I'm installing a new server with the hardened profile, a PaX enabled kernel
> (PAGEEXEC) and a little of grsecurity. The cpu is a recent intel celeron with
> NX bit and 64bit extensions (whatever that means).
>
> I was wondering if the PAGEEXEC feature of PaX is able to detect and
> transparently use the NX bit or if it's enabled for some particular
> architectures only...

if you use a 64 bit kernel (ARCH=x86_64) then PaX will make use of the
hardware NX bit as vanilla itself already uses it (with some cleanup i
added in PaX). note that this holds for both 64 bit and 32 bit userland.

if you want a 32 bit kernel then as of now PaX would NOT use the NX bit,
you're stuck with PAGEEXEC (the supervisor bit based method) or SEGMEXEC.
the reason for this is that when NX was introduced, it was part of amd64
therefore i didn't see much point in adding support for a 32 bit kernel,
people buy a 64 bit CPU to run 64 bit kernels on it. unfortunately, intel
in its infinite wisdom began to add NX support to their CPUs without the
64 bit extensions, so ever since supporting them has been on my todo list,
just no time/motivation to get it done. 

> I've compiled the kernel for pentium3 and built the system
> with -march=pentium3.

that doesn't affect NX use, only the generated code, and you should check
your cpu family before deciding which CPU arch to use.

-- 
gentoo-hardened@g.o mailing list