Pax not working with 2.6.7 and grsec 2.0.1

[einsteinmg]

hi all,

i've tried the new grsecurity[0] and have a few problems:

Code: Select all

# paxtest blackhat
...
Executable anonymous mapping             : Vulnerable
Executable bss                           : Vulnerable
Executable data                          : Vulnerable
Executable heap                          : Vulnerable
Executable stack                         : Vulnerable
Executable anonymous mapping (mprotect)  : Vulnerable
Executable bss (mprotect)                : Vulnerable
Executable data (mprotect)               : Vulnerable
Executable heap (mprotect)               : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect)              : Vulnerable
Anonymous mapping randomisation test     : No randomisation
Heap randomisation test (ET_EXEC)        : 13 bits (guessed)
Heap randomisation test (ET_DYN)         : 13 bits (guessed)
Main executable randomisation (ET_EXEC)  : No randomisation
Main executable randomisation (ET_DYN)   : No randomisation
Shared library randomisation test        : No randomisation
Stack randomisation test (SEGMEXEC)      : 9 bits (guessed)
Stack randomisation test (PAGEEXEC)      : 9 bits (guessed)
Return to function (strcpy)              : Vulnerable
Return to function (strcpy, RANDEXEC)    : Vulnerable
Return to function (memcpy)              : Vulnerable
Return to function (memcpy, RANDEXEC)    : Vulnerable
Executable shared library bss            : Vulnerable
Executable shared library data           : Vulnerable
Writable text segments                   : Vulnerable

but there are nearly all pax options set (also quite all grsec options):

Code: Select all

# zgrep PAX /proc/config.gz
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
# CONFIG_PAX_EI_PAX is not set
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
# CONFIG_PAX_PAGEEXEC is not set
CONFIG_PAX_SEGMEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_NOELFRELOCS is not set
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
# CONFIG_PAX_RANDEXEC is not set
# CONFIG_PAX_NOVSYSCALL is not set

- kernel was 2.6.7 vanilla with valied signature vom kernel.org.
- grsec patch has also a valied signature.
- grsecpatch applies without errors
- kernel compiles without errors
- system is a actual debian SID.

But where is the fault?
Any suggestions what to do?

[0] <http://grsecurity.net/grsecurity-2.0.1-2.6.7.patch>

cu mg

[PaX Team]

But where is the fault?
Any suggestions what to do?

if you want the PT_PAX_FLAGS marking then you'll need the binutils patch as well, else use EI_PAX.

[einsteinmg]

thx... i've enabled EI_PAXand everthing is working fine, ... thx

cu mg