Gentoo Archives: gentoo-hardened

From: "Anthony G. Basile" <basile@××××××××××××××.edu>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel
Date: Fri, 20 Sep 2013 10:30:29
Message-Id: 523C23E7.3050101@opensource.dyc.edu
In Reply to: Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel by Balint Szente
1 On 09/19/2013 12:49 PM, Balint Szente wrote:
2 > Hello!
3 >
4 >
5 > Just a short follow-up: I installed 319.49 as well, but the situation
6 > is the same. A lot of applications give this error:
7 >
8 > error while loading shared libraries: libGL.so.1: failed to map
9 > segment from shared object: Operation not permitted
10 >
11 > So no difference between 325.15 and 319.49 from this point of view.
12 >
13 > I kept MPROTECT after all as you guys recommended, and I decided to use
14 > revdep-pax. Unfortunately I encountered the following issue:
15 >
16 > # revdep-pax -m -l /usr/lib/libGL.so
17 > libGL.so.1 /usr/lib64/opengl/nvidia/lib/libGL.so.319.49 :X86_64 (-em--)
18 >
19 > /usr/bin/cairo-sphinx ( -e--- )
20 > /usr/bin/glxgears ( -e--- )
21 > /usr/lib64/libcairo.so.2.11200.14 ( -e--- )
22 > /usr/bin/vwebp ( -e--- )
23 > /usr/lib64/libwebkitgtk-1.0.so.0.13.4 ( -e--- )
24 > /usr/bin/glxinfo ( -e--- )
25 > /usr/bin/xdriinfo ( -e--- )
26 > /usr/lib64/libglut.so.3.9.0 ( -e--- )
27 > /usr/lib64/libva-glx.so.1.3300.0 ( -e--- )
28 > /usr/lib64/libGLU.so.1.3.1 ( -e--- )
29 > /usr/lib64/va/drivers/vdpau_drv_video.so ( -e--- )
30 >
31 > Will mark elf with -em--
32 >
33 > Set flags for /usr/bin/cairo-sphinx (y/n): y
34 >
35 > /usr/bin/cairo-sphinx ( ----- )
36 >
37 > Set flags for /usr/bin/glxgears (y/n): y
38 >
39 > /usr/bin/glxgears ( ----- )
40 >
41 > The script actually *erased* the pax markings, instead of marking with
42 > -em--:
43 >
44 > # paxctl-ng -v /usr/bin/glxgears
45 > /usr/bin/glxgears:
46 > PT_PAX : -----
47 > XATTR_PAX : -----
48 >
49 > Do you have any ideas about this issue?
50 >
51 > Notes: I use PT markings in kernel, and I have PAX_MARKINGS="PT" in
52 > make.conf.
53 >
54 > Thanks,
55 > Balint
56 >
57 > On Sat, 14 Sep 2013 15:33:56 +0300
58 > Balint Szente <balint@×××××××××.ro> wrote:
59
60
61 I wrote that script but I've never seen this before. I suspect there's
62 something wrong with the pypax python module. Can you test using
63 pypaxctl to set some pax flags on a non-critical elf binary and see if
64 it works.
65
66 --
67 Anthony G. Basile, Ph. D.
68 Chair of Information Technology
69 D'Youville College
70 Buffalo, NY 14201
71 (716) 829-8197

Replies

Subject Author
Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel Balint Szente <balint@×××××××××.ro>