Re: nvidia.ko with Grsecurity & PaX kernel

On 09/19/2013 12:49 PM, Balint Szente wrote:
> Hello!
>
>
> Just a short follow-up: I installed 319.49 as well, but the situation
> is the same. A lot of applications give this error:
>
>   error while loading shared libraries: libGL.so.1: failed to map
>   segment from shared object: Operation not permitted
>
> So no difference between 325.15 and 319.49 from this point of view.
>
> I kept MPROTECT after all as you guys recommended, and I decided to use
> revdep-pax. Unfortunately I encountered the following issue:
>
> # revdep-pax -m -l /usr/lib/libGL.so
> libGL.so.1 /usr/lib64/opengl/nvidia/lib/libGL.so.319.49 :X86_64 (-em--)
>
> 	/usr/bin/cairo-sphinx ( -e--- )
> 	/usr/bin/glxgears ( -e--- )
> 	/usr/lib64/libcairo.so.2.11200.14 ( -e--- )
> 	/usr/bin/vwebp ( -e--- )
> 	/usr/lib64/libwebkitgtk-1.0.so.0.13.4 ( -e--- )
> 	/usr/bin/glxinfo ( -e--- )
> 	/usr/bin/xdriinfo ( -e--- )
> 	/usr/lib64/libglut.so.3.9.0 ( -e--- )
> 	/usr/lib64/libva-glx.so.1.3300.0 ( -e--- )
> 	/usr/lib64/libGLU.so.1.3.1 ( -e--- )
> 	/usr/lib64/va/drivers/vdpau_drv_video.so ( -e--- )
>
> 	Will mark elf with -em--
>
> 	Set flags for /usr/bin/cairo-sphinx (y/n): y
>
> 		/usr/bin/cairo-sphinx ( ----- )
>
> 	Set flags for /usr/bin/glxgears (y/n): y
>
> 		/usr/bin/glxgears ( ----- )
>
> The script actually *erased* the pax markings, instead of marking with
> -em--:
>
> # paxctl-ng -v /usr/bin/glxgears
> /usr/bin/glxgears:
> 	PT_PAX    : -----
> 	XATTR_PAX : -----
>
> Do you have any ideas about this issue?
>
> Notes: I use PT markings in kernel, and I have PAX_MARKINGS="PT" in
> make.conf.
>
> Thanks,
> Balint
>
> On Sat, 14 Sep 2013 15:33:56 +0300
> Balint Szente <[email protected]> wrote:


I wrote that script but I've never seen this before.  I suspect there's 
something wrong with the pypax python module.  Can you test using 
pypaxctl to set some pax flags on a non-critical elf binary and see if 
it works.

-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197