On 9 Jun 2006 at 17:56, Pedro Venda wrote: > I'm installing a new server with the hardened profile, a PaX enabled kernel > (PAGEEXEC) and a little of grsecurity. The cpu is a recent intel celeron with > NX bit and 64bit extensions (whatever that means). > > I was wondering if the PAGEEXEC feature of PaX is able to detect and > transparently use the NX bit or if it's enabled for some particular > architectures only...
if you use a 64 bit kernel (ARCH=x86_64) then PaX will make use of the hardware NX bit as vanilla itself already uses it (with some cleanup i added in PaX). note that this holds for both 64 bit and 32 bit userland. if you want a 32 bit kernel then as of now PaX would NOT use the NX bit, you're stuck with PAGEEXEC (the supervisor bit based method) or SEGMEXEC. the reason for this is that when NX was introduced, it was part of amd64 therefore i didn't see much point in adding support for a 32 bit kernel, people buy a 64 bit CPU to run 64 bit kernels on it. unfortunately, intel in its infinite wisdom began to add NX support to their CPUs without the 64 bit extensions, so ever since supporting them has been on my todo list, just no time/motivation to get it done. > I've compiled the kernel for pentium3 and built the system > with -march=pentium3. that doesn't affect NX use, only the generated code, and you should check your cpu family before deciding which CPU arch to use. -- [email protected] mailing list
