W dniu 30.03.2012 20:12, Ђорђе Тодоровић pisze:
On
Thu, 29 Mar 2012, Sven Vermeulen wrote:
You can try to make it a valid ELF header
first, and then paxmark it.
I have the following for my Skype:
paxctl -C /opt/skype/skype
paxctl -me /opt/skype/skype
I tried running paxctl -Cm on it (should be ran on install with
pax_kernel USE
flag), by it still reports an invalid ELF executable.
This is listed in the ebuld:
if use pax_kernel; then
Â*Â*Â* pax-mark Cm "${D}"/opt/skype/skype || die
Â*Â*Â* eqawarn "You have set USE=pax_kernel meaning that you intend
to run"
Â*Â*Â* eqawarn "skype under a PaX enabled kernel.Â* To do so, we must
modify"
Â*Â*Â* eqawarn "the skype binary itself and this *may* lead to
breakage!Â* If"
Â*Â*Â* eqawarn "you suspect that skype is being broken by this
modification,"
Â*Â*Â* eqawarn "please open a bug."
fi
BTW,I checked the skype changelog and this was added recently:
Â*Â*Â* 29 Feb 2012; mthode <mthode@gentoo.org>
skype-2.2.0.35-r1.ebuild:
Â*Â*Â* fix the paxmarking syntax
Â*Â*Â* Â*Â*Â* 28 Feb 2012; mthode <mthode@gentoo.org>
skype-2.2.0.35-r1.ebuild:
Â*Â*Â* paxmarked m skype to work on hardened
But it somehow fails to complete on my machine when I try it
manually.
I also just checked, my current profile is multilib (I said
earlier no-mulitlib)
I seriously am not sure if it is of any help,but attached the ELF
header of the
skype executable (/opt/skype/skype) so maybe (IDK) someone can
tell if
there is an obvious problem there.
file /opt/skype/skype says:
/opt/skype/skype: ELF 32-bit LSB executable, Intel 80386, version
1 (SYSV), dynamically linked (uses shared libs), stripped
Hi
scanelf -x /opt/skype/skype
Â*TYPEÂ*Â*Â* PAXÂ*Â* FILE
ET_EXEC --mxe- /opt/skype/skype
ls -l /opt/skype/skype
-rwxr-xr-x 1 root root 21362552 03-01 11:22 /opt/skype/skype
Skype works fine on pax-kernel.
Linux localhost 3.3.0-gl1 #1 SMP PREEMPT Wed Mar 28
00:21:14 CEST 2012 x86_64 Intel(R) Core(TM)2 Duo CPU E6750
@ 2.66GHz GenuineIntel GNU/Linux
My Pax configuration:
Â*zgrep -i pax /proc/config.gz
# PaX
CONFIG_PAX=y
# PaX Control
CONFIG_PAX_SOFTMODE=y
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_EMUTRAMP=y
CONFIG_PAX_MPROTECT=y
CONFIG_PAX_MPROTECT_COMPAT=y
CONFIG_PAX_ELFRELOCS=y
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD=""
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_MEMORY_STACKLEAK=y
CONFIG_PAX_REFCOUNT=y
CONFIG_PAX_USERCOPY=y
Â*paxtest blackhat
PaXtest - Copyright(c) 2003,2004 by Peter Busser
<peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser
<peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Mode: blackhat
Linux localhost 3.3.0-gl1 #1 SMP PREEMPT Wed Mar 28 00:21:14 CEST
2012 x86_64 Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz
GenuineIntel GNU/Linux
Executable anonymous mappingÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable bssÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â *Â*Â* : Killed
Executable dataÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* Â*Â* : Killed
Executable heapÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* Â*Â* : Killed
Executable stackÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â *Â* : Killed
Executable shared library bssÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable shared library dataÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable anonymous mapping (mprotect)Â* : Killed
Executable bss (mprotect)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable data (mprotect)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable heap (mprotect)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable stack (mprotect)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Executable shared library bss (mprotect) : Killed
Executable shared library data (mprotect): Killed
Writable text segmentsÂ*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Anonymous mapping randomisation testÂ*Â*Â*Â* : 33 bits (guessed)
Heap randomisation test (ET_EXEC)Â*Â*Â*Â*Â*Â*Â* : 23 bits (guessed)
Heap randomisation test (PIE)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : 40 bits (guessed)
Main executable randomisation (ET_EXEC)Â* : No randomisation
Main executable randomisation (PIE)Â*Â*Â*Â*Â* : 32 bits (guessed)
Shared library randomisation testÂ*Â*Â*Â*Â*Â*Â* : 33 bits (guessed)
Stack randomisation test (SEGMEXEC)Â*Â*Â*Â*Â* : 40 bits (guessed)
Stack randomisation test (PAGEEXEC)Â*Â*Â*Â*Â* : 40 bits (guessed)
Return to function (strcpy)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : paxtest: return address
contains a NULL byte.
Return to function (memcpy)Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Return to function (strcpy, PIE)Â*Â*Â*Â*Â*Â*Â*Â* : paxtest: return address
contains a NULL byte.
Return to function (memcpy, PIE)Â*Â*Â*Â*Â*Â*Â*Â* : Killed
Cheers
