Message-ID: <681852.72532.bm@smtp106.mail.ukl.yahoo.com>
Date: Fri, 13 Apr 2012 13:47:00 +0100
From: Kevin Chadwick <ma1l1ists@yahoo.co.uk>
To: alpine-devel@lists.alpinelinux.org
Subject: Re: [alpine-devel] [announce] Sonnet GNU/Linux (somewhat derivative
 of Alpine)
In-Reply-To: <CA+T2pCH751w58S9hXB7CyTWEY1_aD3CV4qiswDT8M9OiUsDZxw@mail.gmail.com>
References: <CA+T2pCEvey5ztLcjgJAi3aTXLrQz4O3DNiUk5P8C=FVVCGumwg@mail.gmail.com>
	<965117.94628.bm@smtp142.mail.ukl.yahoo.com>
	<CAML-UdtXXNx83NHWu7v8jm2g2mxPpPgvcubezo_VL7BtUuLW5Q@mail.gmail.com>
	<148752.52050.bm@smtp133.mail.ukl.yahoo.com>
	<CA+T2pCH751w58S9hXB7CyTWEY1_aD3CV4qiswDT8M9OiUsDZxw@mail.gmail.com>
Precedence: list
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 11 Apr 2012 23:27:00 +0000
William Pitcock wrote:

> > As I understand it, PAX and grsec make many known exploits fail. What
> > grounds are you arguing this on. The fact mprotect is often disabled?  
> 
> This is false.  The fact that the distribution is compiled with PIE is
> why many known exploits fail. The fact that binaries are compiled
> with PIE allows the ASLR code (either in Linux itself or provided by
> PaX) to randomize specific segment addresses in a binary.  ASLR is the
> reason why ret2libc attacks are not successful.


 I suggest you take these things up with the pax team and
spender. From what I've seen, the CONFIG options of grsec and PAX
prevent exploits. I am really surprised there are so many using
grsecurity and no distro anymore with a grsec enabled kernel.



Excerpt from a response by the pax team on the gentoo hardened list for
CVE-2012-0056.
_________________________________________________________________________________

> BTW this in "vanilla" gentoo does not work because of the permission of the su 
> file:
> ls -l /usr/bin/su
> -rws--x--x 1 root root 36776 18 gen 21.31 /usr/bin/su
> 
> readelf cannot read the address, but there can be other ways to access the 
> binary for example for group "disk"  

http://seclists.org/fulldisclosure/2012/Jan/396

> hardened gentoo is un-affected as expected (but you already know)  

this is not quite true, what could work against grsec is an exploit that
implemented a ret2libc style exploit coupled with bruteforcing (if the
target suid is a PIE). 
^^^^^^^^^^^^^^^^^^^^^

i hope you're all enabling the bruteforce protection feature in
grsec ;).


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---