Re: [gentoo-hardened] grsecurity_and_PaX_config

[Rumen Yotov]

First a great Thanks,

On 17 Jun 2004 09:58:09 -0400
Ned Ludd <solar@g.o> wrote:

> On Thu, 2004-06-17 at 00:54, Rumen Yotov wrote:
> > Hi all,
> > Tried to push grsec&PaX settings to the limits. Used quite all settings from quickstart-guide and got this with paxtest-0.9.5:
> > ...BEGIN CUT ...
> > PaXtest - Copyright(c) 2003 by Peter Busser <peter@×××××××××.org>
> > Released under the GNU Public Licence version 2 or later
> >
> > It may take a while for the tests to complete
> > Test results:
> > PaXtest - Copyright(c) 2003 by Peter Busser <peter@×××××××××.org>
> > Released under the GNU Public Licence version 2 or later
> >
> > Executable anonymous mapping             : Killed
> > Executable bss                           : Killed
> > Executable data                          : Killed
> > Executable heap                          : Killed
> > Executable stack                         : Killed
> > Executable anonymous mapping (mprotect)  : Killed
> > Executable bss (mprotect)                : Killed
> > Executable data (mprotect)               : Killed
> > Executable heap (mprotect)               : Killed
> > Executable shared library bss (mprotect) : Killed
> > Executable shared library data (mprotect): Killed
> > Executable stack (mprotect)              : Killed
> > Anonymous mapping randomisation test     : 16 bits (guessed)
> > Heap randomisation test (ET_EXEC)        : 25 bits (guessed)
> > Heap randomisation test (ET_DYN)         : 25 bits (guessed)
> > Main executable randomisation (ET_EXEC)  : 17 bits (guessed)
> > Main executable randomisation (ET_DYN)   : 17 bits (guessed)
> > Shared library randomisation test        : 16 bits (guessed)
> > Stack randomisation test (SEGMEXEC)      : 23 bits (guessed)
> > Stack randomisation test (PAGEEXEC)      : 23 bits (guessed)
> > Return to function (strcpy)              : Vulnerable
> > Return to function (strcpy, RANDEXEC)    : Vulnerable
> > Return to function (memcpy)              : Vulnerable
> > Return to function (memcpy, RANDEXEC)    : Vulnerable
> > Executable shared library bss            : Killed
> > Executable shared library data           : Killed
> > Writable text segments                   : Killed
> > ... END CUT ...
>
>
> > 1.Could something be done about this 4 'Vuln.' left?
> No thats expected. The goal of paxtest was not to show you how safe you
> were but infact how vuln you are. So.. If you notice in the Makefile it
> explicitly disables -fstack-protector which covers 2 of the remaining 4
> areas which exploitation can happen via. Seeing that it's vuln should
> prove the point why you want/need
> -fstack-protector/-fstack-protector-all which is handled automatically
> with USE=hardened =sys-devel/gcc-3.3.3-r6
>
OK. Done that.But which two, i think: Return to function (strcpy) & Return to function (memcpy), the other two must be handled by PaX RANDEXEC feature?
>
> > PS: can't use ACL for now as i'm on reiserfs3, so no easy acl support still. Am i wrong?
> From reading below it looks like your going to be using grsec. grsec is
> file system independent.
>
Risking being very wrong i know that ACL is a framework over regular filesystem in order to provide stricter control through new extended file attr. and as a result new way top control permissions on files. A week or two ago checked and acl was supported only on ext3 and xfs, reiserfs3 required some patches. So when using gradm2 i think it works with acl to provide additional security, but none on reiserfs3 as it doesn't have extended attributes (ACL). Opinions?
Beside grsec i'm also planning on installing RSBAC-unabled kernel, but thats later. Had adamantix-1.0.3 installed on another partition but now think i'll move it to Gentoo.
TIA.
> > 2.Also managed to get xorg-X11-6.7.0-r1 to work using these settings,
> > compiled it with USE="static -hardened" so no modules loading (thanks
> > to forums.grsecurity.net). But can't get it to work with the
> > binary-nvidia driver 'nvidia' works only with 2-D 'nv' driver, but for
> > now it's enough for me. Nvidia-kernel module is loaded, so maybe it's
> > something to do with loading kernel-glx module and xorg-x11
> > being'static'. Suggestions?
> No easy work around here if your trying to use 3rd party modules.
>
So no surprise here.
> > 3.Problems with paxtest-0.9.6 (still not in portage). Took it from adamantix.org project page. Can't compile it some error there:
> sigh yeah.... I've sent Peter Busser patches for this a number of times
> but for whatever reason he is busy working on other stuff.. The solution
> is easy enough if I recall. add -lpthread to the LDFLAGS in the Makefile
>
>
Thanks again, i'll try it.
> > ..BEGIN CUT...
> > make gentoo
> > make -f Makefile.Gentoo
> > make[1]: Entering directory `/home/gentoo/src/paxtest-0.9.6'
> > gcc -specs=dumpspecs  -o anonmap body.o anonmap.o
> > body.o(.text+0x131): In function `main':
> > : undefined reference to `pthread_create'
> > body.o(.text+0x14a): In function `main':
> > : undefined reference to `pthread_kill'
> > collect2: ld returned 1 exit status
> > make[1]: *** [anonmap] Error 1
> > make[1]: Leaving directory `/home/gentoo/src/paxtest-0.9.6'
> > make: *** [gentoo] Error 2
> > ...END CUT...
>
> > i'm compiling with grsec turned ON and GCC-3.3.3-r6 (hardened i think).
> > paxtest-0.9.5 compiles OK.
> > TIA.
> > Rumen
> --
> Ned Ludd <solar@g.o>
> Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
>
Rumen.