PaX usage on a non-hardened system?

D-LINC

I was reading a little bit about PaX and it seemed like a sensible thing to do for security reasons. Does my Gentoo system already use PaX in some way? I see pax-utils is already installed on my system (though not in my world file) and I seem to remember some messages about PaX marking binaries near the end of merges that I have done.

cach0rr0 · Posted: Tue Dec 20, 2011 7:12 pm Post subject:

PaX has not been accepted into the mainline kernel by upstream, nor are their plans to do so AFAIK
so it will always require separate patching, and thusly hardened-sources on gentoo. It is not a small patch either

people can and do run hardened-* on the desktop, but there are special considerations
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash

Veldrin · Posted: Tue Dec 20, 2011 7:14 pm Post subject:

portage uses pax-utils to modify binaries, that the run on a hardened (PaX enabled) system.
_________________
read the portage output!
If my answer is too concise, ask for an explanation.

nlsa8z6zoz7lyih3ap · Guru Joined: 25 Sep 2007 Posts: 388 Location: Canada

I used to run "hardened" with grsecurity + pax on my desktop and was very happy for a long while. Then something about Grsecurity + Pax changed and I no longer do. The deal breaker for me was this: Even with Grsecurity and Pax totally disabled in kernel's patched with them, the kernel compiled broke my vmware-server which I then used. (I now use vmware-player, but would expect the same results.) It turned out, the grsecurity people told me, that their patches change the kernel even if one disables all of the features. (see https://forums.gentoo.org/viewtopic-p-5154743-highlight-.html#5154743 for more details.) Prior to that I could use vmware with Pax and grsecurity merely by setting

Hu · Moderator Joined: 06 Mar 2007 Posts: 21624

It is true that PaX hardening breaks some of the proprietary modules.

OP: given the ease with which one can switch between hardened and regular kernels of the same base revision, I encourage you to try hardened, especially if your kernel is not tainted. At worst, the machine will panic and require a switch back to a non-hardened kernel.

D-LINC · Posted: Wed Dec 21, 2011 12:39 pm Post subject:

Quick question regarding grsecurity: grsecurity only tightens restrictions on a system, correct? It never increases access to any resource beyond what is allowed by normal Linux permissions, correct? For example, even if I were to completely screw up my grsecurity policy configuration, there is no way the system would be any less secure than it was before I started using grsecurity, right? Just want to be crystal clear on that point.

cach0rr0 · Posted: Wed Dec 21, 2011 2:29 pm Post subject:

D-LINC · Posted: Wed Dec 21, 2011 6:52 pm Post subject:

cach0rr0 · Posted: Wed Dec 21, 2011 10:25 pm Post subject:

nlsa8z6zoz7lyih3ap · Guru Joined: 25 Sep 2007 Posts: 388 Location: Canada

Hu · Moderator Joined: 06 Mar 2007 Posts: 21624

D-LINC · Posted: Thu Dec 22, 2011 9:26 am Post subject:

Could you guys help me with a little troubleshooting? I installed a hardened kernel, as well as the paxctl and pax-util packages. (Haven't installed gradm yet.) After reboot, my Web server won't start (lighttpd). This seems to be the issue:

cach0rr0 · Posted: Thu Dec 22, 2011 10:27 am Post subject:

normally the protocol is to, after you opt to throw a hardened kernel into the mix, switch a hardened profile, re-merge the toolchain, then merge emerge world

the resultant binaries should *still* operate fine under a normal kernel, but IIRC this is needed for them to behave correctly under a hardened kernel
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash

Veldrin · Posted: Thu Dec 22, 2011 1:10 pm Post subject:

Yes, I can confirm, that running a hardened system on a normal kernel works fine.
I never tried the other way around (normal system on hardened kernel).

V.
_________________
read the portage output!
If my answer is too concise, ask for an explanation.

mv · Watchman Joined: 20 Apr 2005 Posts: 6747

nlsa8z6zoz7lyih3ap · Guru Joined: 25 Sep 2007 Posts: 388 Location: Canada

cach0rr0 · Posted: Thu Dec 22, 2011 5:09 pm Post subject:

you are using vmware under hardened
its very design implies interacting with kernel data structures in a way that PaX/grsec were intended to prevent

vmware should not be your benchmark for how well anything else is going to work under hardened
nor should, for example, the binary nvidia drivers

i make heavy use of virtual machines too; vmware-server went to absolute crap with 2.x, so between that, and issues under hardened, i myself opted for KVM over vmware-server.

Either way, there seems to be the implication of, "well, vmware didnt work well under hardened, therefore most things dont work under hardened" - which is not true. Throwing external binary drivers into a hardened kernel is not a good idea in general, and i would fully expect these unique, one-off exceptional cases, to be less than straightforward.

Your issues have absolutely zero, nothing, nada, nil, to do with the stability of hardened. They have everything to do with vmware. There is no need to be more cautious with backups on hardened than you would with any other system (though, you should still as a practice do backups on 'any other system'). There is no legitimate reason to think that hardened is going to kill your dog or kick your babies or anything of the sort.
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash

nlsa8z6zoz7lyih3ap · Guru Joined: 25 Sep 2007 Posts: 388 Location: Canada

I believe that a careful reading of this topic would show that cach0rr0 has understood neither the content nor intent of my posts. I have written to him privately in this regard. I hope that this will be the end of public discussion on
what he calls my

mv · Watchman Joined: 20 Apr 2005 Posts: 6747

This is a bit OT, but since some hardened-specialists seem to be reading:

Has anybody managed to compile clisp and fricas (with clisp) under a hardened kernel with x86? Strange thing is that there is no obvious problem running the compiled binary and also no problem under amd64. However, under x86 it seems that some writable buffer should be executed which the kernel is blocking (therefore killing the compiling clisp process).

I guess if the binary is correspondingly marked with paxctl, it should work.
However, this marking should probably be done in the ebuild which contains no such thing.

Also marking /usr/bin/clisp, allowing everything, does not help compiling fricas which I do not understand at all.

D-LINC · Posted: Thu Dec 22, 2011 7:08 pm Post subject:

Not to be selfish, but could we focus on the vmalloc problem I'm having?

Nothing about any vmalloc settings was mentioned in Gentoo's grsec documentation.

Hu · Moderator Joined: 06 Mar 2007 Posts: 21624

nlsa8z6zoz7lyih3ap · Guru Joined: 25 Sep 2007 Posts: 388 Location: Canada

I would like to thank cach0rr0 for the very helpful private discussions that we have had concerning my previous posts on this topic. He has made it clear to me that my posts do not reflect my real opinions and intent regarding the Hardened Gentoo project. For this I do sincerely apologize. Let me try to rectify this situation belatedly:

(1) In my opinion, the Gentoo-hardened project is one of the best things about Gentoo and certainly ( in my opinion) the best implementation of Pax, Grsecurity and security in general of which I am aware. Moreover Pax and Grsecurity are the only things of which I am aware that truly provide what I would consider to be good security. My use of them extends over many years. In fact I still run hardened on my laptop, but not on the other three Gentoo machines which I maintain.

(2) Ideally I believe that everyone should run at least PaX (and actually RBAC, which is easy to configure, too).

(3) I have never had a serious problem with PaX on a machine that was only running the hardened-sources kernel
with no kernel modules from outside of it, such as the nvidia or vmware modules. In fact at times I have even used it with the nvidia module without major incidents, but I do not recommend doing so. If one is not using outside modules,
my personal recommendation is to use at least PaX and better yet RBAC on any Gentoo system, Desktop, Workstation server or otherwise. Rest assured that because you are using Gentoo, you can choose the Gentoo hardened profile which with PaX etc, will give you an excellence of protection and an ease of implementing it that I am not aware of elsewhere, along with the wonderful Gentoo environment and collection of software in portage.

(4) However my experience has led me to see that if you are using proprietary modules + PaX then there is a possibility of doing serious damage. Such damage is completely avoidable and the intent of my posts was to make it clear how to avoid it. I am very sorry if my posts gave a different impression and give special thanks to cach0rr0 for helping me to see that they might have.

(5) I endorse Hu's excellent advice

D-LINC · Posted: Sun Dec 25, 2011 10:46 pm Post subject:

Hu · Moderator Joined: 06 Mar 2007 Posts: 21624

Based on the messages, I think the problem is that it cannot load a module, not that the module is ipv6.ko. You have some problem such that modprobe just does not work at that stage. It would be good to understand why it does not work, but since it seems that you will have IPv6 permanently loaded if you enable it at all, I suggested including it in the core kernel as a workaround. You can also delete the module and set CONFIG_IPV6=n if you have no use for IPv6.

If you are asking whether I can use IPv6 on my machine, then yes, but I build with it set to =y, not =m as you have done, so the test is not a fair comparison.