grsecurity forums

When i go to the pax download page to get paxctl, I am disappointed that there is no .sig file to download, and indexes on the base url is forbidden. Would it be possible to post these?

by the way, I have now learned that paxctl is probably the wrong way to do it, so I would no longer want a sig file for it. I think it should be preferred to use extended attributes (setfattr command) instead.

Kernel config:

Code: Select all

    Use legacy ELF header marking (PAX_EI_PAX) [N/y/?] (NEW)
    Use ELF program header marking (PAX_PT_PAX_FLAGS) [N/y/?] (NEW)
    Use filesystem extended attributes marking (PAX_XATTR_PAX_FLAGS) [N/y/?] (NEW) y

Setting flags (which I think I got from https://wiki.archlinux.org/index.php/PaX ):

Code: Select all

# get the current flags
getfattr -n user.pax.flags /usr/bin/problematic_binary# set the new flags, no conversion or backup (of the file) necessary (but you could back up the flags if there were some)
# set flags
setfattr -n user.pax.flags -v "mr" /usr/bin/problematic_binary
# remove flags
setfattr -x user.pax.flags /usr/bin/problematic_binary