|
From: Johan E. <jo...@ek...> - 2004-04-30 12:42:45
|
> > CONFIG_GRKERNSEC_PROC_MEMMAP: > > If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat=20 > files will > > give no information about the addresses of its mappings if > > PaX features that rely on random addresses are enabled on the = task. > > If you use PaX it is greatly recommended that you say Y here as it > > closes up a hole that makes the full ASLR useless for suid = binaries. > > =3D=3D=3D=3D > > > > Look at this example: > > > > =3D=3D=3D=3D > > # cat /proc/self/maps > > 00000000-00000000 r-xp 00000000 30:00 19 /bin/cat > > 00000000-00000000 rw-p 00001000 30:00 19 /bin/cat > > 00000000-00000000 rwxp 00000000 00:00 0 > > 00000000-00000000 r-xp 00000000 30:00 60854 /lib/ld-2.3.2.so > > 00000000-00000000 rw-p 00014000 30:00 60854 /lib/ld-2.3.2.so > > 00000000-00000000 r-xp 00000000 30:00 60531 = /lib/libc-2.3.2.so > > 00000000-00000000 rw-p 0012f000 30:00 60531 = /lib/libc-2.3.2.so > > 00000000-00000000 rw-p 00000000 00:00 0 > > 00000000-00000000 r--p 00000000 30:00 85818108 =20 > /usr/lib/locale/locale-archive > > 00000000-00000000 rwxp fffff000 00:00 0 >=20 > Good grief. I wonder how many other programs this breaks? We've been running with this setup for a long time on +20 busy = www-servers with a total of about 18000 users, without any problems = except valgrind. So for a traditional server setup it doesn't seem to = break anything. Can't say anything about X-applications, desktop stuff = etc. /Johan |