On Friday 09 June 2006 19:51, [EMAIL PROTECTED] wrote: > On 9 Jun 2006 at 17:56, Pedro Venda wrote: > > I'm installing a new server with the hardened profile, a PaX enabled > > kernel (PAGEEXEC) and a little of grsecurity. The cpu is a recent intel > > celeron with NX bit and 64bit extensions (whatever that means). > > > > I was wondering if the PAGEEXEC feature of PaX is able to detect and > > transparently use the NX bit or if it's enabled for some particular > > architectures only... > > if you use a 64 bit kernel (ARCH=x86_64) then PaX will make use of the > hardware NX bit as vanilla itself already uses it (with some cleanup i > added in PaX). note that this holds for both 64 bit and 32 bit userland. > > if you want a 32 bit kernel then as of now PaX would NOT use the NX bit, > you're stuck with PAGEEXEC (the supervisor bit based method) or SEGMEXEC. > the reason for this is that when NX was introduced, it was part of amd64 > therefore i didn't see much point in adding support for a 32 bit kernel, > people buy a 64 bit CPU to run 64 bit kernels on it. unfortunately, intel > in its infinite wisdom began to add NX support to their CPUs without the > 64 bit extensions, so ever since supporting them has been on my todo list, > just no time/motivation to get it done.
ok, seems reasonable. > > > I've compiled the kernel for pentium3 and built the system > > with -march=pentium3. > > that doesn't affect NX use, only the generated code, and you should check > your cpu family before deciding which CPU arch to use. About the architecture, I didn't think about it much because I assumed it was like a centrino (don't know why) but then again, I'm not sure the celeron is netburst. I'll check it out Thanks for the information. Best regards, -- Pedro João Lopes Venda email: pjvenda at pjvenda org http://www.pjvenda.org
pgpHYUVkh6pNl.pgp
Description: PGP signature
