|
|
| Line 17: |
Line 17: |
| | --- | | --- |
| | | | |
| − | = Difference.= | + | = Difference= |
| | main system was like that before everything: | | main system was like that before everything: |
| | | | |
| Line 63: |
Line 63: |
| | but after all it can be like that: | | but after all it can be like that: |
| | {{Root|<nowiki> | | {{Root|<nowiki> |
| − | # paxtest blackhat | + | #paxtest blackhat |
| | PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org> | | PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org> |
| | Released under the GNU Public Licence version 2 or later | | Released under the GNU Public Licence version 2 or later |
Revision as of 20:04, 26 November 2010
little overview of that things
i was using funtoo x86_64 stable with few unmasked things for everything - about that things we will talk later.
_DONT_FORGET_: thats only for testing purposes ...
lets part this for .. for example 5 parts ...
1st part. difference
2nd part. hardened toolchain.
3rd part. hardened-sources.
4th part. pax & co.
5th part. !?!?!
---
Difference
main system was like that before everything:
#paxtest blackhat
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Mode: blackhat
Linux u2 2.6.36-rc8 #5 SMP PREEMPT Wed Oct 20 02:57:30 MSD 2010 x86_64 Intel(R) Core(TM)2 Duo CPU E8300 @ 2.83GHz GenuineIntel GNU/Linux
Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable shared library bss : Killed
Executable shared library data : Killed
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable stack (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Writable text segments : Vulnerable
Anonymous mapping randomisation test : 29 bits (guessed)
Heap randomisation test (ET_EXEC) : 14 bits (guessed)
Heap randomisation test (PIE) : 28 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (PIE) : 28 bits (guessed)
Shared library randomisation test : 28 bits (guessed)
Stack randomisation test (SEGMEXEC) : 28 bits (guessed)
Stack randomisation test (PAGEEXEC) : 28 bits (guessed)
Return to function (strcpy) : paxtest: return address contains a NULL byte.
Return to function (memcpy) : Vulnerable
Return to function (strcpy, PIE) : paxtest: return address contains a NULL byte.
Return to function (memcpy, PIE) : Vulnerable
but after all it can be like that:
#paxtest blackhat
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
Released under the GNU Public Licence version 2 or later
Mode: blackhat
Linux u2 2.6.35-hardened-r4 #1 SMP PREEMPT Thu Oct 21 00:29:06 MSD 2010 x86_64 Intel(R) Core(TM)2 Duo CPU E8300 @ 2.83GHz GenuineIntel GNU/Linux
Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable shared library bss : Killed
Executable shared library data : Killed
Executable anonymous mapping (mprotect) : Killed
Executable bss (mprotect) : Killed
Executable data (mprotect) : Killed
Executable heap (mprotect) : Killed
Executable stack (mprotect) : Killed
Executable shared library bss (mprotect) : Killed
Executable shared library data (mprotect): Killed
Writable text segments : Killed
Anonymous mapping randomisation test : 29 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (PIE) : 35 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (PIE) : 27 bits (guessed)
Shared library randomisation test : 29 bits (guessed)
Stack randomisation test (SEGMEXEC) : 35 bits (guessed)
Stack randomisation test (PAGEEXEC) : 35 bits (guessed)
Return to function (strcpy) : paxtest: return address contains a NULL byte.
Return to function (memcpy) : Vulnerable
Return to function (strcpy, PIE) : paxtest: return address contains a NULL byte.
Return to function (memcpy, PIE) : Vulnerable
its "app-admin/paxtest".
it can test your machine and show useful pax-side stuff.
Hardened toolchain
for using hardened system with gentoo - you was need to change your portage profile to the hardened one.
like tha
#ln -sfn /usr/portage/profiles/hardened/linux/2.6/amd64/10.0 /etc/make.profile
#env-update && source /etc/profile
but we will _NOT_ do that.
now we need to clone and use hardened overlay.
1st of all we need to make dir and clone overlay to it ... for example at the /overlay
#mkdir /overlay
#cd /overlay
#git clone git://github.com/damex/hardened.git
after that we need to make proper /etc/make.profile
#rm /etc/make.profile
#mkdir /etc/make.profile
#touch /etc/make.profile/parent
#echo /usr/portage/profiles/default/linux/amd64/2008.0 /etc/make.profile/parent
#echo /overlay/hardened/profiles /etc/make.profile/parent
1st echo - for your current profile. 2nd - for the overlay's. only that priority.
now we'r need to add out overylay to the make.conf
/etc/make.conf
PORTDIR_OVERLAY="/overlay/hardened"
and run
#env-update && source /etc/profile
few new flags like 'hardened' will be used system wide now.
now we can emerge our toolchain
#sudo emerge -av linux-headers gcc libtool
few new flags like 'hardened' will be used system wide now. current gcc (4.3x) have only PIE support (i mean those gcc's that funtoo tree have now ~_~).to use all features of hardened toolchain (PIE/SSP) - we will use gcc-4.4.3-r3 or gcc-4.4.4-r2 (they'r from overlay one). to use that gcc - we may need newer glibc - it must be automatically pickupped form overlay/portage tree. now we can emerge our toolchain
now we need to enable our new gcc:
#gcc-config -l
[1] x86_64-pc-linux-gnu-4.4.3
[2] x86_64-pc-linux-gnu-4.4.3-hardenednopie
[3] x86_64-pc-linux-gnu-4.4.3-hardenednopiessp
[4] x86_64-pc-linux-gnu-4.4.3-hardenednossp
[5] x86_64-pc-linux-gnu-4.4.3-vanilla
#gcc-config x86_64-pc-linux-gnu-4.4.3
#env-update & source /etc/profile
now just emerge other part of toolchain
#sudo emerge -av linux-headers glibc binutils libtool
now its time to run
#sudo etc-update
and recheck your config files.
after config check - its time to remerge whole world.
#sudo emerge -uDeav world
dont forget to make sure that you have all use flags that you want enabled. it will take too long so you can just go away from keyboard.
if something fails with remerge world - dont forget to report
3rd part. hardened-sources.
it can be emerged va
#emerge -av hardened-sources
i'd prefer latest sources so if you too (hope you'd prefer) - just add
/etc/portage/package.keywords
sys-kernel/hardened-sources
its "vanilla-sources" with hardened patches.
its including atleast pax and grsecurity patches now. i will show example of configuring it via
#make menuconfig
wich is working fine for me at the desktop pc.
its placing at the
Security options --->
Grsecurity --->
PaX --->
i will show now configure of pax and then grsecurity
PaX --->
[*] Enable various PaX features
PaX Control --->
[ ] Support soft mode
[*] Use legacy ELF header marking
[*] Use ELF program header marking
MAC system integration (none) --->
Non-executable pages --->
[*] Enforce non-executable pages
[*] Paging based non-executable pages
[ ] Emulate trampolines
[*] Restrict mprotect()
[ ] Allow ELF text relocations (read help)
[ ] Enforce non-executable kernel pages
Address Space Layout Randomization --->
[*] Address Space Layout Randomization
[*] Randomize user stack base
[*] Randomize mmap() base
Miscellaneous hardening features --->
[ ] Sanitize all freed memory
[*] Prevent invalid userland pointer dereference
[ ] Prevent various kernel object reference counter overflows
[ ] Bounds check heap object copies between kernel and userland
Grsecurity --->
[*] Grsecurity
Security Level (Custom) --->
Address Space Protection --->
[*] Deny writing to /dev/kmem, /dev/mem, and /dev/port
[ ] Disable privileged I/O
[*] Remove addresses from /proc/<pid>/[smaps|maps|stat]
[*] Deter exploit bruteforcing
[ ] Harden module auto-loading
[*] Hide kernel symbols
Role Based Access Control Options --->
[*] Disable RBAC system
[*] Hide kernel processes
(5) Maximum tries before password lockout
(30) Time to wait after max password tries, in seconds
Filesystem Protections --->
[*] Proc restrictions
[*] Restrict /proc to user only
[*] Additional restrictions
[*] Linking restrictions
[*] FIFO restrictions
[ ] Runtime read-only mount protection
[*] Chroot jail restrictions
[*] Deny mounts
[*] Deny double-chroots
[*] Deny pivot_root in chroot
[*] Enforce chdir("/") on all chroots
[*] Deny (f)chmod +s
[*] Deny fchdir out of chroot
[*] Deny mknod
[*] Deny shmat() out of chroot
[*] Deny access to abstract AF_UNIX sockets out of chroot
[*] Protect outside processes
[*] Restrict priority changes
[*] Deny sysctl writes
[*] Capability restrictions
Kernel Auditing --->
[ ] Single group for auditing
[ ] Exec logging
[*] Resource logging
[ ] Log execs within chroot
[ ] Ptrace logging
[ ] Chdir logging
[*] (Un)Mount logging
[*] Signal logging
[*] Fork failure logging
[*] Time change logging
[*] /proc/<pid>/ipaddr support
[ ] Denied RWX mmap/mprotect logging
[ ] ELF text relocations logging (READ HELP)
Executable Protections --->
[*] Enforce RLIMIT_NPROC on execs
[*] Dmesg(8) restriction
[*] Deter ptrace-based process snooping
[ ] Trusted Path Execution (TPE)
Network Protections --->
[*] Larger entropy pools
[*] TCP/UDP blackhole and LAST_ACK DoS prevention
[ ] Socket restrictions
Sysctl support --->
[*] Sysctl support
[*] Turn on features by default
Logging Options --->
(10) Seconds in between log messages (minimum)
(4) Number of messages in a burst (maximum)
if you dont need xorg system - then you can enable
[*] Disable privileged I/O
but make sure that you have your hw clock and other things working fine.
if you'r going to enable
[*] Harden module auto-loading
then you can find that your adobe flash and few things more will't functioning
if you need RBAC - then just disable that option
[ ] Disable RBAC system
if your intended to use RBAC - you can find that your Gajim will not work (can't run).
to fix that - you will need updated python (its the same one... but with one important patch), wich you can get just by adding
/etc/portage/package.keywords
dev-lang/python
its revision will always be like portage's rX+1 if its supported.
like now portage have "dev-lang/python-2.6.5-r3" and overlay "dev-lang/python-2.6.5-r4"
if you "newbie" to all that then good point is to enable
[*] Support soft mode
to not have enforce pax features.
other options isnt part of "hardened" patch set and you need to configure then by self.
all kernel configuration && installing will always will be like that:
#make menuconfig
#mount /boot //if needed//
#make && make install && make modules_install
#boot-update //if needed//
better dont compile that sources with many treads (im compiling em with -j1 and sometimes -j2/-j3).
if you will need to be able run boot-update under your PAX enabled system then you will need to disable PAGEEXEC and MPROTECT for */sbin/grub-mkdevicemap* and */sbin/grub-probe* like that
paxctl -pm /sbin/grub-mkdevicemap
paxctl -pm /sbin/grub-probe
next time we will see more examples of pax and little overview of it :3
cya and dont forget that all that still in progress :)
4th part. pax & co.
#paxctl -h
PaX control v0.5
Copyright 2004,2005,2006,2007 PaX Team <pageexec@freemail.hu>
usage: paxctl <options> <files>
options:
-p: disable PAGEEXEC -P: enable PAGEEXEC
-e: disable EMUTRMAP -E: enable EMUTRMAP
-m: disable MPROTECT -M: enable MPROTECT
-r: disable RANDMMAP -R: enable RANDMMAP
-x: disable RANDEXEC -X: enable RANDEXEC
-s: disable SEGMEXEC -S: enable SEGMEXEC
-v: view flags -z: restore default flags
-q: suppress error messages -Q: report flags in short format
-c: convert PT_GNU_STACK into PT_PAX_FLAGS (see manpage!)
-C: create PT_PAX_FLAGS (see manpage!)
it (dis~)allows running different features if hardened (w/ pax support) kernel used.
above descripted each option and i will show few examples with using it on the desktop.
if we'r using hardened desktop then few features will not prop~ functioning and we _maybe_ will want it get working.
lets start:
\"every application that will want something enabled/disabled out of pax features\" - will spam at the dmesg around with others features that pax prevents to be used.
that can be like that
_showing part of dmesg_
PAX: execution attempt in: <anonymous mapping>, 2efaa2e8000-2efaa2eb000 2efaa2e8000
PAX: terminating task: /usr/lib64/paxtest/anonmap(anonmap):24246, uid/euid: 1000/1000, PC: 000002efaa2e8000, SP: 000003c853d02428
PAX: bytes at PC: c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PAX: bytes at SP-8: 000003c853d02530 0000003a9df60fde 0000000000000000 0000003a9df60f85 000002efa9b4b710 0000000000000000 0000000000000000 000002efa9b6ad6d 0000000000000000 000003c853d02538 0000000100000001
grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/lib64/paxtest/anonmap[anonmap:24246] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/lib64/paxtest/anonmap[anonmap:24245] uid/eui$
PAX: execution attempt in: /usr/lib64/paxtest/execbss, 5035596000-5035597000 00002000
PAX: terminating task: /usr/lib64/paxtest/execbss(execbss):24249, uid/euid: 1000/1000, PC: 0000005035596020, SP: 000003f935695dc8
PAX: bytes at PC: c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PAX: bytes at SP-8: 000003f935695ed0 0000005035394f43 0000000000000000 0000005035394f05 000003361ab53710 0000000000000000 0000000000000000 000003361ab72d6d 0000000000000000 000003f935695ed8 0000000100000001
grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/lib64/paxtest/execbss[execbss:24249] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/lib64/paxtest/execbss[execbss:24248] uid/eui$
PAX: execution attempt in: /usr/lib64/paxtest/execdata, cf60ad000-cf60ae000 00002000
PAX: terminating task: /usr/lib64/paxtest/execdata(execdata):24252, uid/euid: 1000/1000, PC: 0000000cf60ad010, SP: 000003d5dc34b7c8
PAX: bytes at PC: c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PAX: bytes at SP-8: 000003d5dc34b8d0 0000000cf5eabee0 0000000000000000 0000000cf5eabea5 0000034f6d10e710 0000000000000000 0000000000000000 0000034f6d12dd6d 0000000000000000 000003d5dc34b8d8 0000000100000001
grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/lib64/paxtest/execdata[execdata:24252] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/lib64/paxtest/execdata[execdata:24251] uid$
PAX: execution attempt in: <anonymous mapping>, 298097e000-29809a0000 298097e000
PAX: terminating task: /usr/lib64/paxtest/execheap(execheap):24255, uid/euid: 1000/1000, PC: 000000298097f080, SP: 000003ed07962bc8
PAX: bytes at PC: c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PAX: bytes at SP-8: 000003ed07962cd0 000000298077bfa8 0000000000000000 000000298077bf65 000003296c266710 0000000000000000 0000000000000000 000003296c285d6d 0000000000000000 000003ed07962cd8 000000010000000
to get few application fully working you will need to do like that:
firefox (will not run?):
paxctl -m /usr/bin/firefox
wine (will not run anything?):
paxctl -pemr /usr/bin/wine*
kde4 (will not able to use screensaver and few other things?)
paxctl -m /usr/bin/kwin
paxctl -m /usr/bin/knotify4
paxctl -m /usr/bin/kded4
paxctl -m /usr/bin/kdeinit4
paxctl -m /usr/bin/nepomuk*
paxctl -m /usr/bin/systemsettings
paxctl -m /usr/bin/*.kss
paxctl -m /usr/lib/misc/xscreensaver/*
xorg-x11 (in few cases X org may not be runned ... rly?)
paxctl -m /usr/bin/X
mplayer (case of using with too old gcc's?)
paxctl -m /usr/bin/mplayer
boot-update (wont run?)
paxctl -pm /sbin/grub-mkdevicemap
paxctl -pm /sbin/grub-probe
most other graphic apps may need too disabling mprotect().
to revert paxctl things to the default - use
paxctl -z /path/to/the/my/binary
after remerging apps - you will need to reapply rules and im using for that purposes bash script. maybe you will want try it too ^_^
like that?:
#!/bin/bash
paxctl -m /usr/bin/firefox
paxctl -pemr /usr/bin/wine*
