Re: PaX options required by clamav

On 29/04/13 09:58, Amon Ott wrote:

> 
> Thank you for finding this out and clarifying!

> Right, softmode is a difficult thing. We could do this, similar to CAP
> behaviour. However, if you switch it off afterwards, the processes keep
> running with more rights that they should have, leaving you with a false
> sense of security. So we would have to go through the process list and
> reset the flags according to the executed program. Possible, but
> annoying with potential to kill half finished jobs.


Don't spend your time with this Amon, just the information about what
PaX softmode does is needed to don't get confused if you suppose
something that don't happen (I got check disabling PaX Flags with clamd,
but it stills got killed), my mistake was to think after this that PaX
Softmode would do something that was not. I finished testing PaX as the
trouble source when I switch it Softmode and it stills killing it.
Knowing this It's trivial to change PaX Flags to perms to testing and
with ldd test one by one any library it uses searching for and if not
check some hardcoded PaX options (as UDEREF could be).

> Thanks once more for all this info. Our handbook could need a lot of
> caring attention. So much work to do and so little time. We would need
> some volunteer or some funded worker to do all the docs properly - and
> continuously over years. So far we have had several volunteers for docs,
> but all of them could not go on for various reasons.
> 
> Amon.

If you wish I could try as volunteer, I'm just a Laboratory technician
(healthcare personnel), and because of this I have not studies in
computer science area, and in consequence I can't give you warranties
about what I'm doing (if a is secure at this way or not). I can warrant
you one thing, I will do my best.

If you want we can use the mail list to send the "patches" in
documentation and if approved by you, merge changes (my english is not
perfect o we could use this to correct mistakes too).

I would need access to the wiki to do it myself.