Re: [gentoo-hardened] 2.6.28-hardened-r7 hangs before starting /sbin/init

On 3 Apr 2009 at 1:22, Alex Efros wrote:
> On Thu, Apr 02, 2009 at 11:17:10PM +0200, pageexec@××××××××.hu wrote:
> > can you strace bash/etc to see what happens? probably we'll see what runs
>
> how do I can strace process N1?

you can enable and boot into softmode then turn it off and see what
you can reproduce then. that won't let you strace pid=1 but let's
you play with the rest while running an MPROTECT kernel.

> PaX doesn't kill bash if it executed not as process N1.

hmm, i don't get it. are you saying that with MPROTECT enabled in the
kernel, bash fails to start when run as init, but works otherwise?

> > against the MPROTECT restricions. my guess is either textrels or gnu_stack
> > (compare scanelf -lpqRte on your systems).
>
> it's same on all servers:

hmm, so nothing stands out, and only pid=1 is ever affected? i've never seen
such a failure mode ;).

> > btw, why are you using SEGMEXEC on your core2?
>
> Hmm. You think I should use PAGEEXEC instead? According to help in linux
> kernel SEGMEXEC looks more suitable for Core2Duo and Xeon E5310...
>
> In help for PAGEEXEC it doesn't recommended for P4 and there is nothing
> about newest processors, so I suppose PAGEEXEC may not be a good choice.

the help talks about exactly what is problematic, the P4 core. the core2
is different, and it also has hw non-exec support.

> After your question I've re-read help, and notice "i386 with hardware
> non-executable bit support" item at end of list with less usual archs like
> avr32, sparc, etc. If that was said about Core/Xeon too, then there
> probably little usability issue with that help. ;-)

i can't possibly list every cpuid that has NX support, up to you to determine
it ;). besides, you can always enable both non-exec features and the kernel
will choose the better one at runtime.