Re: [gentoo-hardened] FYI: Clamav bytecode feature isn't compatible with PaX

[Török Edwin]

On Thu, 22 Jul 2010 23:25:10 +0800
Pavel Labushev <p.labus...@gmail.com> wrote:

> 22.07.2010 19:52, "Tóth Attila" пишет:
> 
> > 1. What is the neat way of detecting PaX running on a system?
> 
> To check /proc/self/status for "PaX:". That's what host-is-pax from
> pax-utils.eclass does.
> 

On Thu, 22 Jul 2010 07:08:30 -0700
Kyle Bader <kyle.ba...@gmail.com> wrote:

> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092
> > http://bugs.gentoo.org/show_bug.cgi?id=326199
> >
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2092#c39
> > It raises two questions:
> > 1. What is the neat way of detecting PaX running on a system?
> 
> http://tk-blog.blogspot.com/2009/02/checksec.html
> 
> > 2. Edwin Török says PaX allows RWX mapping and kills the program
> > after that.
> 
> http://pax.grsecurity.net/docs/pageexec.txt
> 

Thanks. I have implemented PaX detection, see attached patch.

I'll commit it shortly to the ClamAV repository.

Best regards,
--Edwin




diff --git a/libclamav/c++/bytecode2llvm.cpp b/libclamav/c++/bytecode2llvm.cpp
index 22b5413..de01f4c 100644
--- a/libclamav/c++/bytecode2llvm.cpp
+++ b/libclamav/c++/bytecode2llvm.cpp
@@ -1914,6 +1914,7 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned dconfmask)
 	bcs->engine = 0;
 	DEBUG(errs() << "i[34]86 detected, falling back to interpreter (JIT needs pentium or better\n");
 	/* i386 and i486 has to fallback to interpreter */
+	have_clamjit=0;
 	return 0;
     }
     std::string ErrMsg;
@@ -1921,12 +1922,35 @@ int cli_bytecode_init_jit(struct cli_all_bc *bcs, unsigned dconfmask)
     if (B.base() == 0) {
 	errs() << MODULE << ErrMsg << "\n";
 #ifdef __linux__
-	errs() << MODULE << "SELinux is preventing 'execmem' access. Run 'setsebool -P clamd_use_jit on' to allow access\n";
+	errs() << MODULE << "SELinux or PaX is preventing 'execmem' access."
+	    << "Run 'setsebool -P clamd_use_jit on' or 'paxctl -m <executable>' to allow access\n";
 #endif
 	errs() << MODULE << "falling back to interpreter mode\n";
+	have_clamjit=0;
 	return 0;
     } else {
 	sys::Memory::ReleaseRWX(B);
+#ifdef __linux__
+	FILE *f = fopen("/proc/self/status", "r");
+	if (f) {
+	    char line[128];
+	    while (fgets(line, sizeof(line), f)) {
+		if (!memcmp(line, "PaX:", 4)) {
+		    if (cli_debug_flag) {
+			errs() << "bytecode JIT: PaX found: " << line;
+		    }
+		    if (!strchr(line,'m')) {
+			errs() << MODULE << "PaX is preventing MPROTECT, use 'paxctl -m <executable>' to allow\n";
+			errs() << MODULE << "falling back to interpreter mode\n";
+			fclose(f);
+			have_clamjit=0;
+			return 0;
+		    }
+		}
+	    }
+	    fclose(f);
+	}
+#endif
     }
 
     bcs->engine = new(std::nothrow) cli_bcengine;