Re: [gentoo-hardened] Running Skype on Hardened

[Jacek]

W dniu 30.03.2012 20:12, Ђорђе Тодоровић pisze:
> On Thu, 29 Mar 2012, Sven Vermeulen wrote:
>
>> You can try to make it a valid ELF header first, and then paxmark it.
>>
>> I have the following for my Skype:
>> paxctl -C /opt/skype/skype
>> paxctl -me /opt/skype/skype
>
> I tried running paxctl -Cm on it (should be ran on install with
> pax_kernel USE
> flag), by it still reports an invalid ELF executable.
>
> This is listed in the ebuld:
>
> if use pax_kernel; then
>     pax-mark Cm "${D}"/opt/skype/skype || die
>     eqawarn "You have set USE=pax_kernel meaning that you intend to run"
>     eqawarn "skype under a PaX enabled kernel.  To do so, we must modify"
>     eqawarn "the skype binary itself and this *may* lead to breakage!
> If"
>     eqawarn "you suspect that skype is being broken by this
> modification,"
>     eqawarn "please open a bug."
> fi
>
> BTW,I checked the skype changelog and this was added recently:
>     29 Feb 2012; mthode <mthode@g.o> skype-2.2.0.35-r1.ebuild:
>     fix the paxmarking syntax
>         28 Feb 2012; mthode <mthode@g.o> skype-2.2.0.35-r1.ebuild:
>     paxmarked m skype to work on hardened
>
>
> But it somehow fails to complete on my machine when I try it manually.
> I also just checked, my current profile is multilib (I said earlier
> no-mulitlib)
>
> I seriously am not sure if it is of any help,but attached the ELF
> header of the
> skype executable (/opt/skype/skype) so maybe (IDK) someone can tell if
> there is an obvious problem there.
> file /opt/skype/skype says:
> /opt/skype/skype: ELF 32-bit LSB executable, Intel 80386, version 1
> (SYSV), dynamically linked (uses shared libs), stripped
>
>

Hi

    scanelf -x /opt/skype/skype
     TYPE    PAX   FILE
    ET_EXEC --mxe- /opt/skype/skype


    ls -l /opt/skype/skype
    -rwxr-xr-x 1 root root 21362552 03-01 11:22 /opt/skype/skype


*Skype works fine on pax-kernel.*

    Linux localhost 3.3.0-gl1 #1 SMP PREEMPT Wed Mar 28 00:21:14 CEST
    2012 *x86_64* Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz
    GenuineIntel GNU/Linux


My Pax configuration:

    * zgrep -i pax /proc/config.gz *
    # PaX
    CONFIG_PAX=y
    # PaX Control
    CONFIG_PAX_SOFTMODE=y
    CONFIG_PAX_EI_PAX=y
    CONFIG_PAX_PT_PAX_FLAGS=y
    # CONFIG_PAX_NO_ACL_FLAGS is not set
    CONFIG_PAX_HAVE_ACL_FLAGS=y
    # CONFIG_PAX_HOOK_ACL_FLAGS is not set
    CONFIG_PAX_NOEXEC=y
    CONFIG_PAX_PAGEEXEC=y
    CONFIG_PAX_EMUTRAMP=y
    CONFIG_PAX_MPROTECT=y
    CONFIG_PAX_MPROTECT_COMPAT=y
    CONFIG_PAX_ELFRELOCS=y
    CONFIG_PAX_KERNEXEC_PLUGIN_METHOD=""
    CONFIG_PAX_ASLR=y
    CONFIG_PAX_RANDKSTACK=y
    CONFIG_PAX_RANDUSTACK=y
    CONFIG_PAX_RANDMMAP=y
    CONFIG_PAX_MEMORY_STACKLEAK=y
    CONFIG_PAX_REFCOUNT=y
    CONFIG_PAX_USERCOPY=y


     *paxtest blackhat*
    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@×××××××××.org>
    Released under the GNU Public Licence version 2 or later

    Writing output to paxtest.log
    It may take a while for the tests to complete
    Test results:
    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@×××××××××.org>
    Released under the GNU Public Licence version 2 or later

    Mode: blackhat
    Linux localhost 3.3.0-gl1 #1 SMP PREEMPT Wed Mar 28 00:21:14 CEST
    2012 x86_64 Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz GenuineIntel
    GNU/Linux

    Executable anonymous mapping             : Killed
    Executable bss                           : Killed
    Executable data                          : Killed
    Executable heap                          : Killed
    Executable stack                         : Killed
    Executable shared library bss            : Killed
    Executable shared library data           : Killed
    Executable anonymous mapping (mprotect)  : Killed
    Executable bss (mprotect)                : Killed
    Executable data (mprotect)               : Killed
    Executable heap (mprotect)               : Killed
    Executable stack (mprotect)              : Killed
    Executable shared library bss (mprotect) : Killed
    Executable shared library data (mprotect): Killed
    Writable text segments                   : Killed
    Anonymous mapping randomisation test     : 33 bits (guessed)
    Heap randomisation test (ET_EXEC)        : 23 bits (guessed)
    Heap randomisation test (PIE)            : 40 bits (guessed)
    Main executable randomisation (ET_EXEC)  : No randomisation
    Main executable randomisation (PIE)      : 32 bits (guessed)
    Shared library randomisation test        : 33 bits (guessed)
    Stack randomisation test (SEGMEXEC)      : 40 bits (guessed)
    Stack randomisation test (PAGEEXEC)      : 40 bits (guessed)
    Return to function (strcpy)              : paxtest: return address
    contains a NULL byte.
    Return to function (memcpy)              : Killed
    Return to function (strcpy, PIE)         : paxtest: return address
    contains a NULL byte.
    Return to function (memcpy, PIE)         : Killed


Cheers
;)