[gentoo-hardened] persistent paxctl -m?

[gentoo-hardened] persistent paxctl -m?

[Grant]

I seem to need to remember to paxctl -m the firefox binary whenever I
upgrade firefox.  This inevitably leads to a browser crash and lost
time/info.  Can I set up paxctl -m to persist, even if firefox is
upgraded?

- Grant

Re: [gentoo-hardened] persistent paxctl -m?

[klondike]

2009/4/9 Grant <emailgrant@gmail.com>:
> I seem to need to remember to paxctl -m the firefox binary whenever I
> upgrade firefox.  This inevitably leads to a browser crash and lost
> time/info.  Can I set up paxctl -m to persist, even if firefox is
> upgraded?
You can't unless you modify the ebuilds as that info is stored in the
executable file.

The best you can do is open a bug and try to convince the mozilla
maintainers to add that feature.

Re: [gentoo-hardened] persistent paxctl -m?

[Thomas Sachau]

[-- Attachment #1: Type: text/plain, Size: 421 bytes --]

Grant schrieb:
> I seem to need to remember to paxctl -m the firefox binary whenever I
> upgrade firefox.  This inevitably leads to a browser crash and lost
> time/info.  Can I set up paxctl -m to persist, even if firefox is
> upgraded?
> 
> - Grant
> 
> 
paxctl works on a per-binary-base, with a new firefox version, there is a new binary, so cannot persist.

-- 
Thomas Sachau

Gentoo Linux Developer


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 315 bytes --]

Re: [gentoo-hardened] persistent paxctl -m?

[Alex Efros]

Hi!

On Thu, Apr 09, 2009 at 09:07:39AM -0700, Grant wrote:
> I seem to need to remember to paxctl -m the firefox binary whenever I
> upgrade firefox.  This inevitably leads to a browser crash and lost
> time/info.  Can I set up paxctl -m to persist, even if firefox is
> upgraded?

Put this into your /etc/portage/bashrc:
---cut---
if [ "x${EBUILD_PHASE}" != "x" ]; then
    if    [ -x "/etc/portage/bashrc.d/${CATEGORY}/${PF}.${EBUILD_PHASE}" ]; then
        source "/etc/portage/bashrc.d/${CATEGORY}/${PF}.${EBUILD_PHASE}"
    elif  [ -x "/etc/portage/bashrc.d/${CATEGORY}/${P}.${EBUILD_PHASE}"  ]; then
        source "/etc/portage/bashrc.d/${CATEGORY}/${P}.${EBUILD_PHASE}"
    elif  [ -x "/etc/portage/bashrc.d/${CATEGORY}/${PN}.${EBUILD_PHASE}" ]; then
        source "/etc/portage/bashrc.d/${CATEGORY}/${PN}.${EBUILD_PHASE}"
    fi
fi
---cut---

Next, create directory:
    mkdir -p /etc/portage/bashrc.d/www-client/

and create executable shell script in that dir: mozilla-firefox-bin.postinst
---cut---
#!/bin/bash
ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on flash!"
chpax -m /opt/firefox/firefox-bin
---cut---

-- 
			WBR, Alex.

Re: [gentoo-hardened] persistent paxctl -m?

[Alex Efros]

Hi!

On Thu, Apr 09, 2009 at 07:14:11PM +0300, Alex Efros wrote:
> and create executable shell script in that dir: mozilla-firefox-bin.postinst
> ---cut---
> #!/bin/bash
> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on flash!"
> chpax -m /opt/firefox/firefox-bin
> ---cut---

Of course, if you compile firefox instead of using firefox-bin, then file
should be named mozilla-firefox.postinst and you should use there paxctl
instead of chpax.

-- 
			WBR, Alex.

Re: [gentoo-hardened] persistent paxctl -m?

[Ned Ludd]

On Thu, 2009-04-09 at 18:10 +0200, klondike wrote:
> 2009/4/9 Grant <emailgrant@gmail.com>:
> > I seem to need to remember to paxctl -m the firefox binary whenever I
> > upgrade firefox.  This inevitably leads to a browser crash and lost
> > time/info.  Can I set up paxctl -m to persist, even if firefox is
> > upgraded?
> You can't unless you modify the ebuilds as that info is stored in the
> executable file.
> 
> The best you can do is open a bug and try to convince the mozilla
> maintainers to add that feature.


That would be just wrong. firefox itself behaves. It's more likely he is
using a plugin which does not.

-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux

[gentoo-hardened] Re: persistent paxctl -m?

[7v5w7go9ub0o]

Ned Ludd wrote:

> 
> 
> ................... firefox itself behaves. It's more likely he is
> using a plugin which does not.
> 

Ditto the above. No FF problems at all, compiling with the 4.33 overlay 
on AMD64.

Re: [gentoo-hardened] persistent paxctl -m?

[Pavel Labushev]

Alex Efros ?????:
> Hi!
>
> On Thu, Apr 09, 2009 at 07:14:11PM +0300, Alex Efros wrote:
>   
>> and create executable shell script in that dir: mozilla-firefox-bin.postinst
>> ---cut---
>> #!/bin/bash
>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on flash!"
>> chpax -m /opt/firefox/firefox-bin
>> ---cut---
>>     
>
> Of course, if you compile firefox instead of using firefox-bin, then file
> should be named mozilla-firefox.postinst and you should use there paxctl
> instead of chpax.
>   
A simple cron job or slightly-less-simple RBAC policy can do the trick.
There's no need to mess with portage, imho.

Re: [gentoo-hardened] persistent paxctl -m?

[Grant]

>>> and create executable shell script in that dir: mozilla-firefox-bin.postinst
>>> ---cut---
>>> #!/bin/bash
>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on flash!"
>>> chpax -m /opt/firefox/firefox-bin
>>> ---cut---
>>>
>>
>> Of course, if you compile firefox instead of using firefox-bin, then file
>> should be named mozilla-firefox.postinst and you should use there paxctl
>> instead of chpax.
>>
> A simple cron job or slightly-less-simple RBAC policy can do the trick.
> There's no need to mess with portage, imho.

Thanks for the suggestions everyone.  I think this type of persistence
should be built into portage.  Maybe /etc/portage/package.nomprotect.
Do you agree?  Should I file a bug?

- Grant

Re: [gentoo-hardened] persistent paxctl -m?

[atoth]

Don't agree.

If you employ GRsecurity's RBAC, you can use PAX flags, like
"PAX_MPROTECT" on a given subject (binary). Take a look at on the example
policy file.

Regards:
Dw.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057, 06-30-5962-962
Attila Toth MD, Radiologist, +36-20-825-8057, +36-30-5962-962

On Pén, Április 10, 2009 18:29, Grant wrote:
>>>> and create executable shell script in that dir:
>>>> mozilla-firefox-bin.postinst
>>>> ---cut---
>>>> #!/bin/bash
>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on
>>>> flash!"
>>>> chpax -m /opt/firefox/firefox-bin
>>>> ---cut---
>>>>
>>>
>>> Of course, if you compile firefox instead of using firefox-bin, then
>>> file
>>> should be named mozilla-firefox.postinst and you should use there
>>> paxctl
>>> instead of chpax.
>>>
>> A simple cron job or slightly-less-simple RBAC policy can do the trick.
>> There's no need to mess with portage, imho.
>
> Thanks for the suggestions everyone.  I think this type of persistence
> should be built into portage.  Maybe /etc/portage/package.nomprotect.
> Do you agree?  Should I file a bug?
>
> - Grant
>

Re: [gentoo-hardened] persistent paxctl -m?

[Ned Ludd]

> Thanks for the suggestions everyone.  I think this type of persistence
> should be built into portage.  Maybe /etc/portage/package.nomprotect.

> Do you agree?  Should I file a bug?
Not really. No.



-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux

Re: [gentoo-hardened] persistent paxctl -m?

[Alex Efros]

Hi!

On Fri, Apr 10, 2009 at 11:35:36AM +0800, Pavel Labushev wrote:
> A simple cron job or slightly-less-simple RBAC policy can do the trick.
> There's no need to mess with portage, imho.

Cron job is just waste of time (this is one-time task after installing
package, not once-per-minute task) and race condition (after installing
package but before running cron job it may be run and will segfault).

That's not mess with portage because portage right now control PaX flags
for many packages anyway. But it doesn't set PaX flags for firefox or
mplayer, because they able to work without this (if you don't use flash
with firefox and don't use win32codecs with mplayer) and probably because
these packages unlikely will be installed on hardened server.

Also using given /etc/portage/bashrc I not only set paxctl -m, but also
switch gcc to hardened-nossp while compiling several packets (to workaround
http://bugs.gentoo.org/show_bug.cgi?id=217112) and rebuild CPAN module
Scalar::Util after recompiling perl (needed because I don't use portage to
manage perl modules).

So, it used not to mess with portage, but to automate some tasks required
while/after emerging packages to keep system working in my configuration.

-- 
			WBR, Alex.

Re: [gentoo-hardened] persistent paxctl -m?

[Grant]

> If you employ GRsecurity's RBAC, you can use PAX flags, like
> "PAX_MPROTECT" on a given subject (binary). Take a look at on the example
> policy file.

Do you guys think RBAC or /etc/portage/bashrc is a better choice for
this?  Maybe RBAC is overkill if this is all I'll be using it for?

- Grant


>>>>> and create executable shell script in that dir:
>>>>> mozilla-firefox-bin.postinst
>>>>> ---cut---
>>>>> #!/bin/bash
>>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on
>>>>> flash!"
>>>>> chpax -m /opt/firefox/firefox-bin
>>>>> ---cut---
>>>>>
>>>>
>>>> Of course, if you compile firefox instead of using firefox-bin, then
>>>> file
>>>> should be named mozilla-firefox.postinst and you should use there
>>>> paxctl
>>>> instead of chpax.
>>>>
>>> A simple cron job or slightly-less-simple RBAC policy can do the trick.
>>> There's no need to mess with portage, imho.
>>
>> Thanks for the suggestions everyone.  I think this type of persistence
>> should be built into portage.  Maybe /etc/portage/package.nomprotect.
>> Do you agree?  Should I file a bug?
>>
>> - Grant

Re: [gentoo-hardened] persistent paxctl -m?

[atoth]

On Vas, Április 12, 2009 02:03, Grant wrote:
>> If you employ GRsecurity's RBAC, you can use PAX flags, like
>> "PAX_MPROTECT" on a given subject (binary). Take a look at on the
>> example
>> policy file.
>
> Do you guys think RBAC or /etc/portage/bashrc is a better choice for
> this?  Maybe RBAC is overkill if this is all I'll be using it for?
>

It takes time to refine a policy and it needs some tuning from time to
time. If you haven't utilized any RBAC (Grsecurity, RSBAC) on your system
yet, it's high time to give it a try.
So I should say, that bashrc is not the best choice from the security
point of view, but in the mean time it's not an overkill either...

Regards:
Dw.

>
>>>>>> and create executable shell script in that dir:
>>>>>> mozilla-firefox-bin.postinst
>>>>>> ---cut---
>>>>>> #!/bin/bash
>>>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on
>>>>>> flash!"
>>>>>> chpax -m /opt/firefox/firefox-bin
>>>>>> ---cut---
>>>>>>
>>>>>
>>>>> Of course, if you compile firefox instead of using firefox-bin, then
>>>>> file
>>>>> should be named mozilla-firefox.postinst and you should use there
>>>>> paxctl
>>>>> instead of chpax.
>>>>>
>>>> A simple cron job or slightly-less-simple RBAC policy can do the
>>>> trick.
>>>> There's no need to mess with portage, imho.
>>>
>>> Thanks for the suggestions everyone.  I think this type of persistence
>>> should be built into portage.  Maybe /etc/portage/package.nomprotect.
>>> Do you agree?  Should I file a bug?
>>>
>>> - Grant
>