by the way, I have now learned that paxctl is probably the wrong way to do it, so I would no longer want a sig file for it. I think it should be preferred to use extended attributes (setfattr command) instead.
Kernel config:
- Code: Select all
Use legacy ELF header marking (PAX_EI_PAX) [N/y/?] (NEW)
Use ELF program header marking (PAX_PT_PAX_FLAGS) [N/y/?] (NEW)
Use filesystem extended attributes marking (PAX_XATTR_PAX_FLAGS) [N/y/?] (NEW) y
Setting flags (which I think I got from
https://wiki.archlinux.org/index.php/PaX ):
- Code: Select all
# get the current flags
getfattr -n user.pax.flags /usr/bin/problematic_binary# set the new flags, no conversion or backup (of the file) necessary (but you could back up the flags if there were some)
# set flags
setfattr -n user.pax.flags -v "mr" /usr/bin/problematic_binary
# remove flags
setfattr -x user.pax.flags /usr/bin/problematic_binary