When running paxtest I get two tests that should be killed or not work but are still working. I have enabled all useful options under Address Space Protection:
- Code: Select all
[*] Enforce non-executable pages
[ ] Paging based non-executable pages
[*] Segmentation based non-executable pages
[ ] Emulate trampolines
[*] Restrict mprotect()
[ ] Disallow ELF text relocations (DANGEROUS)
[*] Address Space Layout Randomization
[*] Randomize kernel stack base
[*] Randomize user stack base
[*] Randomize mmap() base
[ ] Randomize ET_EXEC base
[ ] Deny writing to /dev/kmem, /dev/mem, and /dev/port
[ ] Disable privileged I/O
[*] Remove addresses from /proc/pid/[maps|stat]
[*] Hide kernel symbols
But:
- Code: Select all
PaXtest - Copyright(c) 2003 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Killed
Executable bss (mprotect) : Killed
Executable data (mprotect) : Killed
Executable heap (mprotect) : Killed
Executable shared library bss (mprotect) : Killed
Executable shared library data (mprotect): Killed
Executable stack (mprotect) : Killed
Anonymous mapping randomisation test : 16 bits (guessed)
Heap randomisation test (ET_EXEC) : 25 bits (guessed)
Heap randomisation test (ET_DYN) : 25 bits (guessed)
Main executable randomisation (ET_EXEC) : 17 bits (guessed)
Main executable randomisation (ET_DYN) : 17 bits (guessed)
Shared library randomisation test : 16 bits (guessed)
Stack randomisation test (SEGMEXEC) : 23 bits (guessed)
Stack randomisation test (PAGEEXEC) : 23 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (strcpy, RANDEXEC) : Vulnerable
Return to function (memcpy) : Return to function (memcpy, RANDEXEC) : Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Killed
I also have "hardened-gcc" (gentoo) installed which does ET_DYN. I have recompiled glibc with hardened-gcc enabled and paxtest with hardened-gcc .
As i was not sure if the fault was in paxtest, or somewhere else, i emerged libsafe (which is listed as masked on gentoo btw) and now everything is working fine for me.