[prev in list] [next in list] [prev in thread] [next in thread]
List: gentoo-hardened
Subject: Re: [gentoo-hardened] FYI: Clamav bytecode feature isn't compatible
From: Török Edwin <edwintorok () gmail ! com>
Date: 2010-07-22 16:27:20
Message-ID: 20100722192720.3c598d42 () debian
[Download RAW message or body]
On Thu, 22 Jul 2010 23:25:10 +0800
Pavel Labushev <p.labushev@gmail.com> wrote:
> 22.07.2010 19:52, "Tóth Attila" пишет:
>
> > 1. What is the neat way of detecting PaX running on a system?
>
> To check /proc/self/status for "PaX:". That's what host-is-pax from
> pax-utils.eclass does.
>
On Thu, 22 Jul 2010 07:08:30 -0700
Kyle Bader <kyle.bader@gmail.com> wrote:
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092
> > http://bugs.gentoo.org/show_bug.cgi?id=326199
> >
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092#c39
> > It raises two questions:
> > 1. What is the neat way of detecting PaX running on a system?
>
> http://tk-blog.blogspot.com/2009/02/checksec.html
>
> > 2. Edwin Török says PaX allows RWX mapping and kills the program
> > after that.
>
> http://pax.grsecurity.net/docs/pageexec.txt
>
Thanks. I have implemented PaX detection, see attached patch.
I'll commit it shortly to the ClamAV repository.
Best regards,
--Edwin
[Attachment #3 (text/x-patch)]
diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp
index 22b5413..de01f4c 100644
--- a/libclamav/c++/bytecode2llvm.cpp
+++ b/libclamav/c++/bytecode2llvm.cpp
@@ -1914,6 +1914,7 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned \
dconfmask) bcs->engine = 0;
DEBUG(errs() << "i[34]86 detected, falling back to interpreter (JIT needs pentium \
or better\n"); /* i386 and i486 has to fallback to interpreter */
+ have_clamjit=0;
return 0;
}
std::string ErrMsg;
@@ -1921,12 +1922,35 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned \
dconfmask) if (B.base() == 0) {
errs() << MODULE << ErrMsg << "\n";
#ifdef __linux__
- errs() << MODULE << "SELinux is preventing 'execmem' access. Run 'setsebool -P \
clamd_use_jit on' to allow access\n"; + errs() << MODULE << "SELinux or PaX is \
preventing 'execmem' access." + << "Run 'setsebool -P clamd_use_jit on' or \
'paxctl -m <executable>' to allow access\n"; #endif
errs() << MODULE << "falling back to interpreter mode\n";
+ have_clamjit=0;
return 0;
} else {
sys::Memory::ReleaseRWX(B);
+#ifdef __linux__
+ FILE *f = fopen("/proc/self/status", "r");
+ if (f) {
+ char line[128];
+ while (fgets(line, sizeof(line), f)) {
+ if (!memcmp(line, "PaX:", 4)) {
+ if (cli_debug_flag) {
+ errs() << "bytecode JIT: PaX found: " << line;
+ }
+ if (!strchr(line,'m')) {
+ errs() << MODULE << "PaX is preventing MPROTECT, use 'paxctl -m <executable>' to \
allow\n"; + errs() << MODULE << "falling back to interpreter mode\n";
+ fclose(f);
+ have_clamjit=0;
+ return 0;
+ }
+ }
+ }
+ fclose(f);
+ }
+#endif
}
bcs->engine = new(std::nothrow) cli_bcengine;
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic