Re: nvidia.ko with Grsecurity & PaX kernel

On Sat, 21 Sep 2013 20:01:57 +0200
Hinnerk van Bruinehsen <h.v.bruinehsen-j/[email protected]> wrote:

> > [...]
> >
> Why would you remove XT-pax flags anyways?

Because I don't use XT flags (yet) and I like to keep things "clean"
and consistent. I have PAX_MARKINGS="PT" in my make.conf, so every ELF
is PT marked only. This was the reason that I removed the XT marks from
the nVidia shared object. On the other hand it excludes the possibility
of inconsistent XT and PT markings.

> It's just xattr (shouldn't
> cause much overhead) and since PT-pax is going to be deprecated (iirc
> soon), you have a backup with the  XT-pax flags (so you don't have
> breakage when the switch occurs).

I know and agree that XT markings are superior, especially for a closed
source binary file where altering the ELF header is not necessarily
safe. But I was thinking to wait until XT-pax markings will get stable
(bug #465000).

Regards,
Balint