| 1 | # Copyright 1999-2006 Gentoo Foundation |
1 | # Copyright 1999-2006 Gentoo Foundation |
| 2 | # Distributed under the terms of the GNU General Public License v2 |
2 | # Distributed under the terms of the GNU General Public License v2 |
| 3 | # $Header: /var/cvsroot/gentoo-x86/eclass/pax-utils.eclass,v 1.3 2006/11/24 15:11:55 kevquinn Exp $ |
3 | # $Header: /var/cvsroot/gentoo-x86/eclass/pax-utils.eclass,v 1.4 2006/12/02 11:33:04 kevquinn Exp $ |
| 4 | |
4 | |
| 5 | # Author: |
5 | # Author: |
| 6 | # Kevin F. Quinn <kevquinn@gentoo.org> |
6 | # Kevin F. Quinn <kevquinn@gentoo.org> |
| 7 | # |
7 | # |
| 8 | # This eclass provides support for manipulating PaX markings on ELF |
8 | # This eclass provides support for manipulating PaX markings on ELF |
| 9 | # binaries, wrapping the use of the chpax and paxctl utilities. |
9 | # binaries, wrapping the use of the chpaxi, paxctl and scanelf utilities. |
|
|
10 | # Currently it decides which to use depending on what is installed on the |
|
|
11 | # build host; this may change in the future to use a control variable |
|
|
12 | # (which would also mean modifying DEPEND to bring in sys-apps/paxctl etc). |
|
|
13 | # |
|
|
14 | # |
|
|
15 | # CONTROL |
|
|
16 | # ------- |
|
|
17 | # |
|
|
18 | # To control what markings are set, assign PAX_MARKINGS in |
|
|
19 | # /etc/make.conf to contain the strings "EI" and/or "PT". |
|
|
20 | # If EI is present in PAX_MARKINGS (and the chpax utility |
|
|
21 | # is present), the legacy 'chpax' style markings will be |
|
|
22 | # set. If PT is present in PAX_MARKINGS (and the paxctl |
|
|
23 | # utility is present), the 'paxctl' markings will be set. |
|
|
24 | # Default is to try to do both. Set it to "NONE" to prevent |
|
|
25 | # any markings being made. |
|
|
26 | # |
|
|
27 | # |
|
|
28 | # PROVIDED FUNCTIONS |
|
|
29 | # ------------------ |
|
|
30 | # |
|
|
31 | #### pax-mark <flags> {<ELF files>} |
|
|
32 | # Marks files <files> with provided PaX flags <flags> |
|
|
33 | # |
|
|
34 | # Please confirm any relaxation of restrictions with the |
|
|
35 | # Gentoo Hardened team; either ask on the gentoo-hardened |
|
|
36 | # mailing list, or CC/assign hardened@g.o on a bug. |
|
|
37 | # |
|
|
38 | # Flags are passed directly to the utilities unchanged. Possible |
|
|
39 | # flags at the time of writing, taken from /sbin/paxctl, are: |
|
|
40 | # |
|
|
41 | # p: disable PAGEEXEC P: enable PAGEEXEC |
|
|
42 | # e: disable EMUTRMAP E: enable EMUTRMAP |
|
|
43 | # m: disable MPROTECT M: enable MPROTECT |
|
|
44 | # r: disable RANDMMAP R: enable RANDMMAP |
|
|
45 | # s: disable SEGMEXEC S: enable SEGMEXEC |
|
|
46 | # |
|
|
47 | # Default flags are 'PeMRS', which are the most restrictive |
|
|
48 | # settings. Refer to http://pax.grsecurity.net/ for details |
|
|
49 | # on what these flags are all about. There is an obsolete |
|
|
50 | # flag 'x'/'X' which has been removed from PaX. |
|
|
51 | # |
|
|
52 | # If chpax is not installed, the legacy EI flags (which are |
|
|
53 | # not strip-safe, and strictly speaking violate the ELF spec) |
|
|
54 | # will not be set. If paxctl is not installed, it falls back |
|
|
55 | # to scanelf. scanelf is always present, but currently doesn't |
|
|
56 | # quite do all that paxctl can do. |
|
|
57 | # Returns fail if one or more files could not be marked. |
|
|
58 | # |
|
|
59 | # |
|
|
60 | #### list-paxables {<files>} |
|
|
61 | # Prints to stdout all of <files> that are suitable to having PaX |
|
|
62 | # flags (i.e. filter to just ELF files). Useful for passing wild-card |
|
|
63 | # lists of files to pax-mark, although in general it is preferable |
|
|
64 | # for ebuilds to list precisely which executables are to be marked. |
|
|
65 | # Use like: |
|
|
66 | # pax-mark -m $(list-paxables ${S}/{,usr/}bin/*) |
|
|
67 | # |
|
|
68 | # |
|
|
69 | #### host-is-pax |
|
|
70 | # Returns true if the host has a PaX-enabled kernel, false otherwise. |
|
|
71 | # Intended for use where the build process must be modified conditionally |
|
|
72 | # in order to satisfy PaX. Note; it is _not_ intended to indicate |
|
|
73 | # whether the final executables should satisfy PaX - executables should |
|
|
74 | # always be marked appropriately even if they're only going to be |
|
|
75 | # installed on a non-PaX system. |
| 10 | |
76 | |
| 11 | inherit eutils |
77 | inherit eutils |
| 12 | |
78 | |
| 13 | ##### pax-mark #### |
79 | # Default to both EI and PT markings. |
| 14 | # Mark a file for PaX, with the provided flags, and log it into |
80 | PAX_MARKINGS=${PAX_MARKINGS:="EI PT"} |
| 15 | # a PaX database. Returns non-zero if flag marking failed. |
|
|
| 16 | # |
|
|
| 17 | # If paxctl is installed, but not chpax, then the legacy |
|
|
| 18 | # EI flags (which are not strip-safe) will not be set. |
|
|
| 19 | # If neither are installed, falls back to scanelf (which |
|
|
| 20 | # is always present, but currently doesn't quite do all |
|
|
| 21 | # that paxctl can do). |
|
|
| 22 | _pax_list_files() { |
|
|
| 23 | local m cmd |
|
|
| 24 | m=$1 ; shift |
|
|
| 25 | for f in $*; do |
|
|
| 26 | ${cmd} " ${f}" |
|
|
| 27 | done |
|
|
| 28 | } |
|
|
| 29 | |
81 | |
|
|
82 | # pax-mark <flags> {<ELF files>} |
| 30 | pax-mark() { |
83 | pax-mark() { |
| 31 | local f flags fail=0 failures="" |
84 | local f flags fail=0 failures="" |
|
|
85 | # Ignore '-' characters - in particular so that it doesn't matter if |
|
|
86 | # the caller prefixes with - |
| 32 | flags=${1//-} |
87 | flags=${1//-} |
| 33 | shift |
88 | shift |
| 34 | if [[ -x /sbin/chpax ]]; then |
89 | # Try chpax, for (deprecated) EI legacy marking. |
|
|
90 | if type -p chpax > /dev/null && hasq EI ${PAX_MARKINGS}; then |
| 35 | einfo "Legacy EI PaX marking -${flags}" |
91 | einfo "Legacy EI PaX marking -${flags}" |
| 36 | _pax_list_files echo $* |
92 | _pax_list_files echo "$@" |
| 37 | for f in $*; do |
93 | for f in "$@"; do |
| 38 | /sbin/chpax -${flags} ${f} && continue |
94 | /sbin/chpax -${flags} "${f}" && continue |
| 39 | fail=1 |
95 | fail=1 |
| 40 | failures="${failures} ${f}" |
96 | failures="${failures} ${f}" |
| 41 | done |
97 | done |
| 42 | fi |
98 | fi |
| 43 | if [[ -x /sbin/paxctl ]]; then |
99 | # Try paxctl, then scanelf - paxctl takes precedence |
|
|
100 | # over scanelf. |
|
|
101 | if type -p paxctl > /dev/null && hasq PT ${PAX_MARKINGS}; then |
|
|
102 | # Try paxctl, the upstream supported tool. |
| 44 | einfo "PT PaX marking -${flags}" |
103 | einfo "PT PaX marking -${flags}" |
| 45 | _pax_list_files echo $* |
104 | _pax_list_files echo "$@" |
| 46 | for f in $*; do |
105 | for f in "$@"; do |
| 47 | /sbin/paxctl -q${flags} ${f} && continue |
106 | /sbin/paxctl -q${flags} "${f}" && continue |
| 48 | /sbin/paxctl -qc${flags} ${f} && continue |
107 | /sbin/paxctl -qc${flags} "${f}" && continue |
| 49 | /sbin/paxctl -qC${flags} ${f} && continue |
108 | /sbin/paxctl -qC${flags} "${f}" && continue |
| 50 | fail=1 |
109 | fail=1 |
| 51 | failures="${failures} ${f}" |
110 | failures="${failures} ${f}" |
| 52 | done |
111 | done |
| 53 | elif [[ -x /usr/bin/scanelf ]]; then |
112 | elif type -p scanelf > /dev/null && [[ -n ${PAX_MARKINGS} ]]; then |
|
|
113 | # Try scanelf, Gentoo's swiss-army knife ELF utility |
|
|
114 | # Currently this sets EI and PT if it can, no option to |
|
|
115 | # control what it does. |
| 54 | einfo "Fallback PaX marking -${flags}" |
116 | einfo "Fallback PaX marking -${flags}" |
| 55 | _pax_list_files echo $* |
117 | _pax_list_files echo "$@" |
| 56 | /usr/bin/scanelf -Xxz ${flags} $* |
118 | /usr/bin/scanelf -Xxz ${flags} "$@" |
| 57 | else |
119 | else |
|
|
120 | # Out of options! |
| 58 | failures="$*" |
121 | failures="$*" |
| 59 | fail=1 |
122 | fail=1 |
| 60 | fi |
123 | fi |
| 61 | if [[ ${fail} == 1 ]]; then |
124 | if [[ ${fail} == 1 ]]; then |
| 62 | ewarn "Failed to set PaX markings -${flags} for:" |
125 | ewarn "Failed to set PaX markings -${flags} for:" |
| … | |
… | |
| 64 | ewarn "Executables may be killed by PaX kernels." |
127 | ewarn "Executables may be killed by PaX kernels." |
| 65 | fi |
128 | fi |
| 66 | return ${fail} |
129 | return ${fail} |
| 67 | } |
130 | } |
| 68 | |
131 | |
|
|
132 | # list-paxables {<files>} |
|
|
133 | list-paxables() { |
|
|
134 | file "$@" 2> /dev/null | grep ELF | sed -e 's/: .*$//' |
|
|
135 | } |
|
|
136 | |
| 69 | ##### host-is-pax |
137 | # host-is-pax |
| 70 | # Indicates whether the build machine has PaX or not; intended for use |
138 | # Note: if procfs is not on /proc, this returns False (e.g. Gentoo/FBSD). |
| 71 | # where the build process must be modified conditionally in order to satisfy PaX. |
|
|
| 72 | host-is-pax() { |
139 | host-is-pax() { |
| 73 | # We need procfs to work this out. PaX is only available on Linux, |
|
|
| 74 | # so result is always false on non-linux machines (e.g. Gentoo/*BSD) |
|
|
| 75 | [[ -e /proc/self/status ]] || return 1 |
|
|
| 76 | grep ^PaX: /proc/self/status > /dev/null |
140 | grep -qs ^PaX: /proc/self/status |
| 77 | return $? |
|
|
| 78 | } |
141 | } |
|
|
142 | |
|
|
143 | |
|
|
144 | # INTERNAL FUNCTIONS |
|
|
145 | # ------------------ |
|
|
146 | # |
|
|
147 | # These functions are for use internally by the eclass - do not use |
|
|
148 | # them elsewhere as they are not supported (i.e. they may be removed |
|
|
149 | # or their function may change arbitratily). |
|
|
150 | |
|
|
151 | # Display a list of things, one per line, indented a bit, using the |
|
|
152 | # display command in $1. |
|
|
153 | _pax_list_files() { |
|
|
154 | local f cmd |
|
|
155 | cmd=$1 |
|
|
156 | shift |
|
|
157 | for f in "$@"; do |
|
|
158 | ${cmd} " ${f}" |
|
|
159 | done |
|
|
160 | } |
|
|
161 | |
Parent Directory
| 
Revision Log
| 
Patch