I've two servers with Intel Xeon 3.2GHz (HT + EM64T) CPU each. I've recently set them up with AMD64 Hardened Gentoo (PIC+SSP enabled GCC, PAX+grsecurity kernel). The first one works as it ought to work - paxtest gives expected results. But the second one...:
- Code: Select all
Executable anonymous mapping : Vulnerable
Executable bss : Vulnerable
Executable data : Vulnerable
Executable heap : Vulnerable
Executable stack : Vulnerable
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable stack (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Writable text segments : Killed
Anonymous mapping randomisation test : 33 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 40 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : No randomisation
Shared library randomisation test : 33 bits (guessed)
Stack randomisation test (SEGMEXEC) : 40 bits (guessed)
Stack randomisation test (PAGEEXEC) : 40 bits (guessed)
Return to function (strcpy) : paxtest: bad luck, try different compiler options.
Return to function (memcpy) : Killed
Return to function (strcpy, RANDEXEC) : paxtest: bad luck, try different compiler options.
Return to function (memcpy, RANDEXEC) : Killed
Executable shared library bss : Killed
Executable shared library data : Killed
Moreover, kernel configuration is almost the same on both servers! It differs only about SCSI controller and software raid support...
- Code: Select all
adeliae ~ # diff kernel-cfgs/ad1 kernel-cfgs/an1
4c4
< # Tue Feb 21 15:06:54 2006
---
> # Mon Feb 20 22:11:55 2006
30c30
< CONFIG_LOCALVERSION="-ad1"
---
> CONFIG_LOCALVERSION="-an1"
484c484,490
< # CONFIG_SCSI_AIC79XX is not set
---
> CONFIG_SCSI_AIC79XX=y
> CONFIG_AIC79XX_CMDS_PER_DEVICE=32
> CONFIG_AIC79XX_RESET_DELAY_MS=15000
> CONFIG_AIC79XX_ENABLE_RD_STRM=y
> # CONFIG_AIC79XX_DEBUG_ENABLE is not set
> CONFIG_AIC79XX_DEBUG_MASK=0
> # CONFIG_AIC79XX_REG_PRETTY_PRINT is not set
516c522,532
< # CONFIG_MD is not set
---
> CONFIG_MD=y
> CONFIG_BLK_DEV_MD=y
> # CONFIG_MD_LINEAR is not set
> # CONFIG_MD_RAID0 is not set
> CONFIG_MD_RAID1=y
> # CONFIG_MD_RAID10 is not set
> # CONFIG_MD_RAID5 is not set
> # CONFIG_MD_RAID6 is not set
> # CONFIG_MD_MULTIPATH is not set
> # CONFIG_MD_FAULTY is not set
> # CONFIG_BLK_DEV_DM is not set
521,522c537,538
< CONFIG_FUSION=y
< CONFIG_FUSION_SPI=y
---
> # CONFIG_FUSION is not set
> # CONFIG_FUSION_SPI is not set
525,526d540
< CONFIG_FUSION_MAX_SGE=128
< # CONFIG_FUSION_CTL is not set
567,568c581
< CONFIG_E1000=y
< # CONFIG_E1000_NAPI is not set
---
> # CONFIG_E1000 is not set
adeliae ~ #
Pax is configured on both servers as follows:
- Code: Select all
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_NOELFRELOCS is not set
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
Here's some chpax result (just for one server, 'cause both give the same results):
- Code: Select all
antarctica linux # chpax -v /usr/lib64/paxtest/mprotdata
----[ chpax 0.7 : Current flags for /usr/lib64/paxtest/mprotdata (PeMRxS) ]----
* Paging based PAGE_EXEC : enabled (overridden)
* Trampolines : not emulated
* mprotect() : restricted
* mmap() base : randomized
* ET_EXEC base : not randomized
* Segmentation based PAGE_EXEC : enabled
antarctica linux #
Everything seems to be ok, but paxtest shows it isn't... I really have no idea. Can anyone help me? I would be very grateful
![:-)](./images/smilies/icon_smile.gif)