From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1Px2Pr-0000OI-1V for garchives@archives.gentoo.org; Tue, 08 Mar 2011 19:17:55 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E3B4FE0504; Tue, 8 Mar 2011 19:16:26 +0000 (UTC) Received: from mail-fx0-f53.google.com (mail-fx0-f53.google.com [209.85.161.53]) by pigeon.gentoo.org (Postfix) with ESMTP id 8D060E0504 for ; Tue, 8 Mar 2011 19:16:26 +0000 (UTC) Received: by fxm20 with SMTP id 20so8047915fxm.40 for ; Tue, 08 Mar 2011 11:16:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:in-reply-to:references:from :date:x-google-sender-auth:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=UPLHKPndz3kNbJ3grGbah2Z1SwqsX7HyddFNOSde/2E=; b=JHjA0mDbXt8VToEsg1hScJaIYKAPVVEijBWTTeWrUrb8Gghl+810ndkO48FCxySmAD cOgFSZ94alVOAN5C4qeHOS/RiwglyeZTJoeJ2luxkaA8BBGFZOU2HqT/FGKSJNOgyQE4 6P7FR6/a+cRNBQq66J0uCOggRG5AEYc3Ae4wg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type :content-transfer-encoding; b=E6TOUH2gGZPCkqHie7YLEwNS9bp9W41LZfK8+ZsObSvMMLhbtqD1LrNu8dECqq4d1+ yfNWMEfOMPyfvFU3/kaP3XWW8WoKLGMsHLODQJB4tH490uWghLXYg96xsccV1tr3nueV X/EMlu/HrKDH2kZPTa8rEvKR/9EPZTpAUE7go= Received: by 10.223.134.85 with SMTP id i21mr2156100fat.25.1299611669694; Tue, 08 Mar 2011 11:14:29 -0800 (PST) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Sender: vapierfilter@gmail.com Received: by 10.223.112.143 with HTTP; Tue, 8 Mar 2011 11:05:46 -0800 (PST) In-Reply-To: <20110308184041.GE3281@home.power> References: <20090306215141.GA3005@home.power> <49B19FEB.13855.19525701@pageexec.freemail.hu> <20090306225746.GA2278@home.power> <1236381916.8071.25.camel@hangover> <20110308184041.GE3281@home.power> From: Mike Frysinger Date: Tue, 8 Mar 2011 14:05:46 -0500 X-Google-Sender-Auth: rgkS9lloIjFaAvaOr81pF2UjywU Message-ID: Subject: Re: [gentoo-hardened] 2.6.27-hardened-r8: assassination To: gentoo-hardened@lists.gentoo.org Cc: Alex Efros Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-Archives-Salt: X-Archives-Hash: 9f9d9a3d96ed41a7edca48bd0ea9bd00 On Tue, Mar 8, 2011 at 1:40 PM, Alex Efros wrote: > On Fri, Mar 06, 2009 at 03:25:16PM -0800, Ned Ludd wrote: >> > On Fri, Mar 06, 2009 at 11:12:59PM +0200, pageexec@freemail.hu wrote: >> > > ah crap, i know what it is. it's a several years old glibc bug where= someone >> > > put a certain variable into the RELRO segment but forgot that it'll = be written >> > > to later when a library with RWE GNU_STACK is loaded. the workaround= is >> > > to find that library (just extract them from strace, probably it'll = be >> > > pari's library) and run execstack -c on it. >> > >> > I don't have execstack command. Looks like it belong to prelink packag= e, >> > but http://www.gentoo.org/doc/en/prelink-howto.xml states it's >> > incompatible with hardened. Because of this I decide to compile it >> > manually, just to get execstack command: >> > >> > # emerge -f prelink >> > # cd /usr/src >> > # tar xjvf /usr/portage-distfiles/prelink-20071009.tar.bz2 >> > # cd prelink >> > # ./configure && make >> > >> > Now I tried your workaround: >> > >> > # /usr/src/prelink/src/execstack -c /usr/lib/perl5/site_perl/5.8.8/i68= 6-linux/auto/Math/Pari/Pari.so >> > # /usr/src/prelink/src/execstack -c /usr/local/ioncube/ioncube_loader_= lin_5.2.so >> > # /usr/src/prelink/src/execstack -c /usr/local/Zend/lib/ZendExtensionM= anager.so >> > # /usr/src/prelink/src/execstack -c /usr/local/Zend/lib/ZendExtensionM= anager_TS.so >> > # /usr/src/prelink/src/execstack -c /usr/local/Zend/lib/Optimizer-3.3.= 0/php-5.2.x/ZendOptimizer.so >> > >> > and it works!! >> > >> > Is this issue will be fixed in next stable hardened-sources? >> >> FYI.. PaX Team maintains the PaX kernel and has little control over what >> fixes go into the "next" hardened-sources. Also seems to me a little >> strange that the PaX Team would have to put a work-around in the kernel >> for a bug in glibc.. Seems like glibc should be fixed vs the kernel. > > 2 years later=85 Just updated system, bug still exists, and I still have = to > use execstack workaround for zendoptimizer and ioncube. like they said, this doesnt seem to be a bug in the kernel, so the pax source arent going to be changing if there's a bug in glibc, an actual bug in bugs.g.o needs to be opened with real details/patches. otherwise, nothing is going to change. -mike