Re: Exec-Shield vs. PaX

[pageexec@freemail.hu]

> >    first of all, it's multithreaded. [...]
> 
> paxtest does not link to libpthread, nor does it create threads, at all.
> How can you claim it's multithreaded?

i did not. if you quote my post like this:

>    let me get back to the topic of java as i promised above. java
>    is a nice animal as it shows several issues with Exec-Shield.
> 
>    first of all, it's multithreaded. glibc creates executable
>    thread stacks by default. [...]

it will be clear that i was referring to java.

> >  glibc creates executable thread stacks by default. [...]
> 
> to the contrary, glibc does this:
> [snip]
>  $ rpm -q glibc
>  glibc-2.3.2-101

that's what RedHat's glibc does. and this is what i get on gentoo
(again, sorry for the plug, although i think other distros like
debian would show the same as well):

$ epm -q glibc
glibc-2.3.2-r8

excerpt from the maps file of /opt/blackdown-jdk-1.4.1/bin/java
(running under PaX but without non-exec pages, randomization
was still on):

b7b7f000-b7b80000 +++p 00000000 00:00 0
b7b80000-b7b8e000 RWXp 00001000 00:00 0
b7b8e000-b7b91000 +++p 0000f000 00:00 0
b7b91000-b7c00000 RWXp 00012000 00:00 0
b7d7f000-b7d80000 +++p 00000000 00:00 0
b7d80000-b7d8e000 RWXp 00001000 00:00 0
b7d8e000-b7d91000 +++p 0000f000 00:00 0
b7d91000-b7e00000 RWXp 00012000 00:00 0
b7f7f000-b7f80000 +++p 00000000 00:00 0
b7f80000-b8000000 RWXp 00001000 00:00 0
b8500000-b850a000 RWXp 00000000 00:00 0
b850a000-b850d000 +++p 00000000 00:00 0
b86f2000-b86fb000 RWXp ffff8000 00:00 0

regardless of whether RedHat fixed this or not (i hope it will enter
the main glibc tree btw), the fundemantal problem of changing memory
protections without asking stays there (LinuxThreads was just one
known way to trigger it).