PaX Team @paxteam
pax.grsecurity.net/
Joined February 2010
  • Tweets 548
  • Following 2
  • Followers 2,766
Load newest
Replying to @ochsff
4.10 is around the corner, afterwards it's time for 4.4. gives us time to find out any outstanding issues too.
Replying to @justinschuh @InfiltrateCon
i'm told that you'll find your match there :)
1
today's grsecurity release for linux 4.9 adds the promised return checking to the public version of RAP: grsecurity.net/rap_announce_… @epakskape
3
97
2
74
Replying to @epakskape
excellent, now all you need is RAP and you're the best in the business ;). congrats, you 'got it' before anyone else!
1
1
8
Replying to @epakskape
is it as strong as MPROTECT+SDCG would be?
1
undergrad C test by the linux stable series maintainer (@gregkh): openwall.com/lists/kernel-ha…
1
8
6
Replying to @solardiz @nelhage @DirtyCOWVuln
sry, was too terse, it applies to executable and RELRO mappings only. not that if any of that matters here.
1
Replying to @nelhage @DirtyCOWVuln
MPROTECT in PaX prevents that.
1
2
1
5
Replying to @rootkovska
what about device VMs, can they run in vmx or only as paravirt?
as for what GRKERNSEC_CONFIG_AUTO does, read the config help instead of guessing ;).
you said it was enabled by default, now you're saying it's not? confused...
Replying to @rootkovska
in xen/hvm everything should work i think, only paravirt (dom0) is problematic for KERNEXEC/UDEREF.
1
5
Replying to @micahflee
i doubt grsec detects ret2libc anywhere in userland, you'd need something like RAP to recompile userland first (works here ;).
Replying to @mkolsek @thegrugq @Snowden @subgraph @QubesOS
i don't think i ever wrote about the big picture, maybe one day...
where did i say Kconfig?
that's not PaX, and it's not default on, see the 'if' part? config_auto is off by default.
good thing we don't have any such plugins ;).
by default everything is off and patches are welcome for better wording.
gcc's plugin architecture makes it impossible, but i told you that before, didn't i?
and when did i not deal with 'it'? (your not reading the docs isn't my fault but yours)
1
Load more