1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
=head1 NAME
B<revdep-pax> - find mismatching PaX markings between ELF objects and their libraries
=head1 SYNOPSIS
B<revdep-pax> -f [-v]
B<revdep-pax> -r [-ve]
B<revdep-pax> -b OBJECT [-mv]
B<revdep-pax> -s SONAME [-mve]
B<revdep-pax> -l LIBRARY [-mve]
B<revdep-pax> [-h]
=head1 DESCRIPTION
B<revdep-pax> finds mismatching PaX markings between an ELF object and the
libraries which that object dynamically links against. When executing an ELF
binary that links against libraries, the PaX hardened kernel ignores the libraries'
markings and uses the executable's markings to enforce PaX restrictions.
It is desireable in some circumstances to reverse migrate a library's markings
to the binaries that link against it.
revdep-pax can either forward migrate PaX markings from an ELF object to its
libraries, or reverse migrate from a library to all the objects that link
against it. The library can either be specified by its SONAME as it is reported
by B<ldd>(1), or by the full path to the LIBRARY file. Symbolic links are
dereferenced. The user can optionally scan for all forward mappings on the
system (-f), for all reverse mappings (-r), for forward mappings of just one
OBJECT (-b), for reverse mappings of just one SONAME (-s) or one LIBRARY (-l).
In verbose mode (-v), all mappings are reported, not just mismatching ones,
and in mark mode (-m), the user is prompted whether to proceed with the migration,
so that the PaX flags of the target inherit the flags of the source.
=head1 OPTIONS
=over
=item B<-f> Scan the system for all forward mappings.
=item
=item B<-r> Scan the system for all reverse mappings.
=item
=item B<-b> OBJECT Retrieve only the forward mappings for this ELF OBJECT.
=item
=item B<-s> SONAME Retrieve only the reverse mappings for this SONAME.
=item
=item B<-l> LIBRARY Retrieve only the reverse mappings for this LIBRARY.
=item
=item B<-m> Prompt the user to mark the found object with the PaX flags of the source.
=item
=item B<-v> Report all mappings, not just the mismatched ones.
=item
=item B<-e> If -m is chosen, then limit the markings to only those executables in the current shell's $PATH. If -v is chosen, then similarly limit the report. This flag only has effect for reverse mappings, i.e., for -r, -s or -l.
=item
=item B<-h> Print out a short help message and exit.
=back
=head1 HOMEPAGE
http://dev.gentoo.org/~blueness/elfix
=head1 REPORTING BUGS
Please report bugs at http://bugs.gentoo.org.
=head1 SEE ALSO
B<scanelf>(1), B<dumpelf>(1), B<paxctl>(1), B<pspax>(1), B<fix-gnustack>(1), B<ldd>(1)
=head1 AUTHORS
B<Anthony G. Basile> <blueness@gentoo.org>
|
GitWeb