* Re: [gentoo-hardened] FYI: Clamav bytecode feature isn't compatible with PaX
2010-07-22 15:25 ` Pavel Labushev
@ 2010-07-22 16:27 ` Török Edwin
0 siblings, 0 replies; 4+ messages in thread
From: Török Edwin @ 2010-07-22 16:27 UTC (permalink / raw
To: gentoo-hardened; +Cc: p.labushev, Kyle Bader
[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]
On Thu, 22 Jul 2010 23:25:10 +0800
Pavel Labushev <p.labushev@gmail.com> wrote:
> 22.07.2010 19:52, "Tóth Attila" пишет:
>
> > 1. What is the neat way of detecting PaX running on a system?
>
> To check /proc/self/status for "PaX:". That's what host-is-pax from
> pax-utils.eclass does.
>
On Thu, 22 Jul 2010 07:08:30 -0700
Kyle Bader <kyle.bader@gmail.com> wrote:
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092
> > http://bugs.gentoo.org/show_bug.cgi?id=326199
> >
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092#c39
> > It raises two questions:
> > 1. What is the neat way of detecting PaX running on a system?
>
> http://tk-blog.blogspot.com/2009/02/checksec.html
>
> > 2. Edwin Török says PaX allows RWX mapping and kills the program
> > after that.
>
> http://pax.grsecurity.net/docs/pageexec.txt
>
Thanks. I have implemented PaX detection, see attached patch.
I'll commit it shortly to the ClamAV repository.
Best regards,
--Edwin
[-- Attachment #2: pax.patch --]
[-- Type: text/x-patch, Size: 1726 bytes --]
diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp
index 22b5413..de01f4c 100644
--- a/libclamav/c++/bytecode2llvm.cpp
+++ b/libclamav/c++/bytecode2llvm.cpp
@@ -1914,6 +1914,7 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned dconfmask)
bcs->engine = 0;
DEBUG(errs() << "i[34]86 detected, falling back to interpreter (JIT needs pentium or better\n");
/* i386 and i486 has to fallback to interpreter */
+ have_clamjit=0;
return 0;
}
std::string ErrMsg;
@@ -1921,12 +1922,35 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned dconfmask)
if (B.base() == 0) {
errs() << MODULE << ErrMsg << "\n";
#ifdef __linux__
- errs() << MODULE << "SELinux is preventing 'execmem' access. Run 'setsebool -P clamd_use_jit on' to allow access\n";
+ errs() << MODULE << "SELinux or PaX is preventing 'execmem' access."
+ << "Run 'setsebool -P clamd_use_jit on' or 'paxctl -m <executable>' to allow access\n";
#endif
errs() << MODULE << "falling back to interpreter mode\n";
+ have_clamjit=0;
return 0;
} else {
sys::Memory::ReleaseRWX(B);
+#ifdef __linux__
+ FILE *f = fopen("/proc/self/status", "r");
+ if (f) {
+ char line[128];
+ while (fgets(line, sizeof(line), f)) {
+ if (!memcmp(line, "PaX:", 4)) {
+ if (cli_debug_flag) {
+ errs() << "bytecode JIT: PaX found: " << line;
+ }
+ if (!strchr(line,'m')) {
+ errs() << MODULE << "PaX is preventing MPROTECT, use 'paxctl -m <executable>' to allow\n";
+ errs() << MODULE << "falling back to interpreter mode\n";
+ fclose(f);
+ have_clamjit=0;
+ return 0;
+ }
+ }
+ }
+ fclose(f);
+ }
+#endif
}
bcs->engine = new(std::nothrow) cli_bcengine;
^ permalink raw reply related [flat|nested] 4+ messages in thread