ATTN SPENDER/PAX TEAM: PaX + sparc64

[mikecc]

I have been complaining to spender over and over why no 64bit binaries worked on my SPARC64 machine, well I figured it out:

mike@faders:~$ gcc test.c -o test -m64
mike@faders:~$ ./test
Segmentation fault
mike@faders:~$ /sbin/chpax -pmxrs test
mike@faders:~$ ./test
hello world
mike@faders:~$

So basically, whats up with PaX and sparc64? I did a chpax on my gradm binary, and that works beautifully, so I am happy as can be.

Mike

[PaX Team]

I have been complaining to spender over and over why no 64bit binaries worked on my SPARC64 machine, well I figured it out:

the answer is simple: more than a year ago when i was working on the sparc port, i couldn't figure out how to create 64 bit apps, so EMUPLT didn't really get tested. apparently things have improved a bit since although i still can't get gdb to debug 64 bit coredumps... anyway, in the meantime you can disable MPROTECT and apps will work.

[mikecc]

no way, disabling mprotect will take away some of the securities pax/grsecurity gives me, correct? this is the only 64bit app I use (gradm), and using chpax on it makes it work, so im happy.

[PaX Team]

no way, disabling mprotect will take away some of the securities pax/grsecurity gives me, correct?

well, i meant to disable MPROTECT on your 64 bit apps only, not in general, and yes, MPROTECT is the one feature that gives the PaX guarantees but you're already using a platform that needs PLT emulation which is bad for both performance and security.

this is the only 64bit app I use (gradm), and using chpax on it makes it work, so im happy.

why do you need gradm to be a 64 bit app?

[mikecc]

im runninga 64bit kernel, on a 64bit arch. so spender says when im running a 64bit arch, it will build a 64bit binary of gradm, so in essence, i need to chpax it for it to work. so far ACLs have been running fantastic on my machine and im loving it.