gentoo-x86/eclass/pax-utils.eclass

# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/eclass/pax-utils.eclass,v 1.14 2011/07/08 11:35:01 ssuominen Exp $

# @ECLASS: pax-utils.eclass
# @MAINTAINER:
# The Gentoo Linux Hardened Team <hardened@gentoo.org>
# @AUTHOR:
# Original Author: Kevin F. Quinn <kevquinn@gentoo.org>
# Modifications for bug #365825, @ ECLASS markup: Anthony G. Basile <blueness@gentoo.org>
# @BLURB: functions to provide pax markings
# @DESCRIPTION:
# This eclass provides support for manipulating PaX markings on ELF binaries,
# wrapping the use of the paxctl and scanelf utilities.  It decides which to
# use depending on what is installed on the build host, preferring paxctl to
# scanelf.  If paxctl is not installed, we fall back to scanelf since it is
# always present.  However, currently scanelf doesn't do all that paxctl can.
#
# To control what markings are made, set PAX_MARKINGS in /etc/make.conf to
# contain either "PT" or "none".  If PAX_MARKINGS is set to "PT", and the
# necessary utility is installed, the PT_PAX_FLAGS markings will be made.  If
# PAX_MARKINGS is set to "none", no markings will be made.

inherit eutils

# Default to PT markings.
PAX_MARKINGS=${PAX_MARKINGS:="PT"}

# @FUNCTION: pax-mark
# @USAGE: <flags> {<ELF files>}
# @RETURN: Shell true if we succeed, shell false otherwise
# @DESCRIPTION:
# Marks <ELF files> with provided PaX <flags>
#
# Flags are passed directly to the utilities unchanged.  Possible flags at the
# time of writing, taken from /sbin/paxctl, are:
#
#       p: disable PAGEEXEC             P: enable PAGEEXEC
#       e: disable EMUTRMAP             E: enable EMUTRMAP
#       m: disable MPROTECT             M: enable MPROTECT
#       r: disable RANDMMAP             R: enable RANDMMAP
#       s: disable SEGMEXEC             S: enable SEGMEXEC
#
# Default flags are 'PeMRS', which are the most restrictive settings.  Refer
# to http://pax.grsecurity.net/ for details on what these flags are all about.
# Do not use the obsolete flag 'x'/'X' which has been deprecated.
#
# Please confirm any relaxation of restrictions with the Gentoo Hardened team.
# Either ask on the gentoo-hardened mailing list, or CC/assign hardened@g.o on
# the bug report.
pax-mark() {
        local f flags fail=0 failures="" zero_load_alignment
        # Ignore '-' characters - in particular so that it doesn't matter if
        # the caller prefixes with -
        flags=${1//-}
        shift
        # Try paxctl, then scanelf.  paxctl is preferred.
        if type -p paxctl > /dev/null && has PT ${PAX_MARKINGS}; then
                # Try paxctl, the upstream supported tool.
                elog "PT PaX marking -${flags}"
                _pax_list_files elog "$@"
                for f in "$@"; do
                        # First, try modifying the existing PAX_FLAGS header
                        paxctl -q${flags} "${f}" && continue
                        # Second, try stealing the (unused under PaX) PT_GNU_STACK header
                        paxctl -qc${flags} "${f}" && continue
                        # Third, try pulling the base down a page, to create space and
                        # insert a PT_GNU_STACK header (works on ET_EXEC)
                        paxctl -qC${flags} "${f}" && continue
                        #
                        # prelink is masked on hardened so we wont use this method.
                        # We're working on a new utiity to try to do the same safely. See
                        # http://git.overlays.gentoo.org/gitweb/?p=proj/elfix.git;a=summary
                        #
                        # Fourth - check if it loads to 0 (probably an ET_DYN) and if so,
                        # try rebasing with prelink first to give paxctl some space to
                        # grow downwards into.
                        #if type -p objdump > /dev/null && type -p prelink > /dev/null; then
                        #       zero_load_alignment=$(objdump -p "${f}" | \
                        #               grep -E '^[[:space:]]*LOAD[[:space:]]*off[[:space:]]*0x0+[[:space:]]' | \
                        #               sed -e 's/.*align\(.*\)/\1/')
                        #       if [[ ${zero_load_alignment} != "" ]]; then
                        #               prelink -r $(( 2*(${zero_load_alignment}) )) &&
                        #               paxctl -qC${flags} "${f}" && continue
                        #       fi
                        #fi
                        fail=1
                        failures="${failures} ${f}"
                done
        elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then
                # Try scanelf, the Gentoo swiss-army knife ELF utility
                # Currently this sets PT if it can, no option to control what it does.
                elog "Fallback PaX marking -${flags}"
                _pax_list_files elog "$@"
                scanelf -Xxz ${flags} "$@"
        elif [[ ${PAX_MARKINGS} != "none" ]]; then
                # Out of options!
                failures="$*"
                fail=1
        fi
        if [[ ${fail} == 1 ]]; then
                ewarn "Failed to set PaX markings -${flags} for:"
                _pax_list_files ewarn ${failures}
                ewarn "Executables may be killed by PaX kernels."
        fi
        return ${fail}
}

# @FUNCTION: list-paxables
# @USAGE: {<files>}
# @RETURN: Subset of {<files>} which are ELF executables or shared objects
# @DESCRIPTION:
# Print to stdout all of the <files> that are suitable to have PaX flag
# markings, i.e., filter out the ELF executables or shared objects from a list
# of files.  This is useful for passing wild-card lists to pax-mark, although
# in general it is preferable for ebuilds to list precisely which ELFS are to
# be marked.  Often not all the ELF installed by a package need remarking.
# @EXAMPLE:
# pax-mark -m $(list-paxables ${S}/{,usr/}bin/*)
list-paxables() {
        file "$@" 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//'
}

# @FUNCTION: host-is-pax
# @RETURN: Shell true if the build process is PaX enabled, shell false otherwise
# @DESCRIPTION:
# This is intended for use where the build process must be modified conditionally
# depending on whether the host is PaX enabled or not.  It is not intedened to
# determine whether the final binaries need PaX markings.  Note: if procfs is
# not mounted on /proc, this returns shell false (e.g. Gentoo/FBSD).
host-is-pax() {
        grep -qs ^PaX: /proc/self/status
}


# INTERNAL FUNCTIONS
# ------------------
#
# These functions are for use internally by the eclass - do not use
# them elsewhere as they are not supported (i.e. they may be removed
# or their function may change arbitratily).

# Display a list of things, one per line, indented a bit, using the
# display command in $1.
_pax_list_files() {
        local f cmd
        cmd=$1
        shift
        for f in "$@"; do
                ${cmd} "     ${f}"
        done
}

1	blueness	1.11	# Copyright 1999-2011 Gentoo Foundation
2	kevquinn	1.1	# Distributed under the terms of the GNU General Public License v2
3	vapier	1.15	# $Header: /var/cvsroot/gentoo-x86/eclass/pax-utils.eclass,v 1.14 2011/07/08 11:35:01 ssuominen Exp $
4	kevquinn	1.1
5	blueness	1.11	# @ECLASS: pax-utils.eclass
6			# @MAINTAINER:
7	vapier	1.15	# The Gentoo Linux Hardened Team <hardened@gentoo.org>
8			# @AUTHOR:
9			# Original Author: Kevin F. Quinn <kevquinn@gentoo.org>
10			# Modifications for bug #365825, @ ECLASS markup: Anthony G. Basile <blueness@gentoo.org>
11	blueness	1.11	# @BLURB: functions to provide pax markings
12			# @DESCRIPTION:
13			# This eclass provides support for manipulating PaX markings on ELF binaries,
14			# wrapping the use of the paxctl and scanelf utilities. It decides which to
15			# use depending on what is installed on the build host, preferring paxctl to
16			# scanelf. If paxctl is not installed, we fall back to scanelf since it is
17			# always present. However, currently scanelf doesn't do all that paxctl can.
18			#
19			# To control what markings are made, set PAX_MARKINGS in /etc/make.conf to
20			# contain either "PT" or "none". If PAX_MARKINGS is set to "PT", and the
21			# necessary utility is installed, the PT_PAX_FLAGS markings will be made. If
22			# PAX_MARKINGS is set to "none", no markings will be made.
23
24			inherit eutils
25
26			# Default to PT markings.
27			PAX_MARKINGS=${PAX_MARKINGS:="PT"}
28
29			# @FUNCTION: pax-mark
30			# @USAGE: <flags> {<ELF files>}
31			# @RETURN: Shell true if we succeed, shell false otherwise
32			# @DESCRIPTION:
33			# Marks <ELF files> with provided PaX <flags>
34	kevquinn	1.4	#
35	blueness	1.11	# Flags are passed directly to the utilities unchanged. Possible flags at the
36			# time of writing, taken from /sbin/paxctl, are:
37	kevquinn	1.4	#
38			# p: disable PAGEEXEC P: enable PAGEEXEC
39			# e: disable EMUTRMAP E: enable EMUTRMAP
40			# m: disable MPROTECT M: enable MPROTECT
41			# r: disable RANDMMAP R: enable RANDMMAP
42			# s: disable SEGMEXEC S: enable SEGMEXEC
43			#
44	blueness	1.11	# Default flags are 'PeMRS', which are the most restrictive settings. Refer
45			# to http://pax.grsecurity.net/ for details on what these flags are all about.
46			# Do not use the obsolete flag 'x'/'X' which has been deprecated.
47			#
48			# Please confirm any relaxation of restrictions with the Gentoo Hardened team.
49			# Either ask on the gentoo-hardened mailing list, or CC/assign hardened@g.o on
50			# the bug report.
51	kevquinn	1.1	pax-mark() {
52	kevquinn	1.6	local f flags fail=0 failures="" zero_load_alignment
53	kevquinn	1.4	# Ignore '-' characters - in particular so that it doesn't matter if
54			# the caller prefixes with -
55	kevquinn	1.3	flags=${1//-}
56	kevquinn	1.2	shift
57	blueness	1.11	# Try paxctl, then scanelf. paxctl is preferred.
58	ssuominen	1.14	if type -p paxctl > /dev/null && has PT ${PAX_MARKINGS}; then
59	kevquinn	1.4	# Try paxctl, the upstream supported tool.
60	kevquinn	1.7	elog "PT PaX marking -${flags}"
61	kevquinn	1.5	_pax_list_files elog "$@"
62	kevquinn	1.4	for f in "$@"; do
63	kevquinn	1.6	# First, try modifying the existing PAX_FLAGS header
64	kevquinn	1.5	paxctl -q${flags} "${f}" && continue
65	kevquinn	1.6	# Second, try stealing the (unused under PaX) PT_GNU_STACK header
66	kevquinn	1.5	paxctl -qc${flags} "${f}" && continue
67	kevquinn	1.6	# Third, try pulling the base down a page, to create space and
68			# insert a PT_GNU_STACK header (works on ET_EXEC)
69	kevquinn	1.5	paxctl -qC${flags} "${f}" && continue
70	blueness	1.12	#
71			# prelink is masked on hardened so we wont use this method.
72			# We're working on a new utiity to try to do the same safely. See
73			# http://git.overlays.gentoo.org/gitweb/?p=proj/elfix.git;a=summary
74			#
75	kevquinn	1.6	# Fourth - check if it loads to 0 (probably an ET_DYN) and if so,
76			# try rebasing with prelink first to give paxctl some space to
77			# grow downwards into.
78	blueness	1.12	#if type -p objdump > /dev/null && type -p prelink > /dev/null; then
79			# zero_load_alignment=$(objdump -p "${f}" \| \
80			# grep -E '^[[:space:]]LOAD[[:space:]]off[[:space:]]*0x0+[[:space:]]' \| \
81			# sed -e 's/.align\(.\)/\1/')
82			# if [[ ${zero_load_alignment} != "" ]]; then
83			# prelink -r $(( 2*(${zero_load_alignment}) )) &&
84			# paxctl -qC${flags} "${f}" && continue
85			# fi
86			#fi
87	kevquinn	1.3	fail=1
88			failures="${failures} ${f}"
89			done
90	kevquinn	1.5	elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then
91	kevquinn	1.6	# Try scanelf, the Gentoo swiss-army knife ELF utility
92	blueness	1.11	# Currently this sets PT if it can, no option to control what it does.
93	kevquinn	1.7	elog "Fallback PaX marking -${flags}"
94	kevquinn	1.5	_pax_list_files elog "$@"
95			scanelf -Xxz ${flags} "$@"
96			elif [[ ${PAX_MARKINGS} != "none" ]]; then
97	kevquinn	1.4	# Out of options!
98	kevquinn	1.3	failures="$*"
99	kevquinn	1.2	fail=1
100	kevquinn	1.1	fi
101	kevquinn	1.3	if [[ ${fail} == 1 ]]; then
102			ewarn "Failed to set PaX markings -${flags} for:"
103			_pax_list_files ewarn ${failures}
104			ewarn "Executables may be killed by PaX kernels."
105			fi
106	kevquinn	1.2	return ${fail}
107			}
108
109	blueness	1.11	# @FUNCTION: list-paxables
110			# @USAGE: {<files>}
111			# @RETURN: Subset of {<files>} which are ELF executables or shared objects
112			# @DESCRIPTION:
113			# Print to stdout all of the <files> that are suitable to have PaX flag
114			# markings, i.e., filter out the ELF executables or shared objects from a list
115			# of files. This is useful for passing wild-card lists to pax-mark, although
116			# in general it is preferable for ebuilds to list precisely which ELFS are to
117			# be marked. Often not all the ELF installed by a package need remarking.
118			# @EXAMPLE:
119			# pax-mark -m $(list-paxables ${S}/{,usr/}bin/*)
120	kevquinn	1.4	list-paxables() {
121	kevquinn	1.6	file "$@" 2> /dev/null \| grep -E 'ELF.(executable\|shared object)' \| sed -e 's/: .$//'
122	kevquinn	1.4	}
123
124	blueness	1.11	# @FUNCTION: host-is-pax
125			# @RETURN: Shell true if the build process is PaX enabled, shell false otherwise
126			# @DESCRIPTION:
127			# This is intended for use where the build process must be modified conditionally
128			# depending on whether the host is PaX enabled or not. It is not intedened to
129			# determine whether the final binaries need PaX markings. Note: if procfs is
130			# not mounted on /proc, this returns shell false (e.g. Gentoo/FBSD).
131	kevquinn	1.2	host-is-pax() {
132	kevquinn	1.4	grep -qs ^PaX: /proc/self/status
133			}
134
135
136			# INTERNAL FUNCTIONS
137			# ------------------
138			#
139			# These functions are for use internally by the eclass - do not use
140			# them elsewhere as they are not supported (i.e. they may be removed
141			# or their function may change arbitratily).
142
143			# Display a list of things, one per line, indented a bit, using the
144			# display command in $1.
145			_pax_list_files() {
146			local f cmd
147			cmd=$1
148			shift
149			for f in "$@"; do
150			${cmd} " ${f}"
151			done
152	kevquinn	1.1	}
153	kevquinn	1.4