No eXecute and Atom, the current MeeGo state

The security of your box goes over the firewall, or the fact that you are running a platform where all binaries are trusted. Even on that case, is still possible that vulnerabilities of some software or library could be exploited by a malicious party.

The idea behind the NX bit, No eXecute, is to segregate the areas of the memory in two (lets keep it simple :P) big sets, the code execution area and the storage area. According to Wikipedia (http://en.wikipedia.org/wiki/List_of_Intel_Atom_microprocessors), the Atom family has the capability to handle such bit.

Adding this feature and a Linux kernel, is possible to avoid the execution of code in the data area, protecting the system against buffer overflows attack. However some marks should be placed on ELFs to archive such protection, these marks are made in the ELF construction and they can mark the ELF to have or not an executable stack. In the second case the executable flag has no effect, is useless.

The marking can also be made on a library (it is also an ELF, duh!) and when this happens, the software which loads that library will be also allowed to run code inside the data segment, disabling again the protection against buffer overflow.

To check the executable marks of your ELFs, you can use the pax-utils (http://www.gentoo.org/proj/en/hardened/pax-utils.xml). Running the tests on a daily MeeGo image (2010-22-07) the following results were archived:


[root@localhost ~]# scanelf -lpqeR
RWX --- --- /usr/lib/libmono.so.0.0.0
RWX --- --- /usr/lib/paxtest/getmain2
RWX --- --- /usr/lib/paxtest/getheap2
RWX --- --- /usr/bin/mono

This means that libmono and mono, for some reason, are expected to run code on the data segment of the memory. In Fedora the mono is marked as RW, I dunno why it is marked as RWX in MeeGo, further investigation should be done.

Mono’s GNU_STACK on Fedora:

(zimmerle@burbs)-(~/core/meego)$ readelf -l /usr/bin/mono | grep GNU_STACK
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000

Is acceptable to have some process without such kind of protecting, for example Java. Java depends on the executable stack to work. It is also acceptable to have some other binaries like: getmain2 and getheap2. These are used to test if the Machine is handling well the NX bit.

To check if your platform has handled well the support of the NX bit, you can use the pax-test, really nice utility that allows us to check the protection against various kinds of exploration. Tests were also made on the same release used above.

kidde mode:

PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>Released under the GNU Public Licence version 2 or later

Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>Released under the GNU Public Licence version 2 or later

Mode: kiddie
Linux localhost.localdomain 2.6.35~rc6-131.2-netbook #1 SMP PREEMPT Tue Jul 27 14:34:50 UTC 2010 i686 i686 i386 GNU/Linux

Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 12 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 16 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 10 bits (guessed)
Shared library randomisation test : No randomisation
Stack randomisation test (SEGMEXEC) : 19 bits (guessed)
Stack randomisation test (PAGEEXEC) : 19 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (strcpy, RANDEXEC) : Vulnerable
Return to function (memcpy) : Vulnerable
Return to function (memcpy, RANDEXEC) : Vulnerable
Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Vulnerable

blackhat mode:

PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>Released under the GNU Public Licence version 2 or later

Writing output to paxtest.log
It may take a while for the tests to complete
Test results:
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>Released under the GNU Public Licence version 2 or later

Mode: blackhat
Linux localhost.localdomain 2.6.35~rc6-131.2-netbook #1 SMP PREEMPT Tue Jul 27 14:34:50 UTC 2010 i686 i686 i386 GNU/Linux

Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Vulnerable
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 12 bits (guessed)
Heap randomisation test (ET_EXEC) : 13 bits (guessed)
Heap randomisation test (ET_DYN) : 16 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 10 bits (guessed)
Shared library randomisation test : No randomisation
Stack randomisation test (SEGMEXEC) : 19 bits (guessed)
Stack randomisation test (PAGEEXEC) : 19 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (strcpy, RANDEXEC) : Vulnerable
Return to function (memcpy) : Vulnerable
Return to function (memcpy, RANDEXEC) : Vulnerable
Executable shared library bss : Killed
Executable shared library data : Killed
Writable text segments : Vulnerable

As you can see, we are protected against code execution in any other area than that intended for this purpose. We don’t have randomization on libs due the fact that we are making use of the prelink, subject for another post .

The pax-utils and pax-test pacakges can be found on my security MeeGo repostiory, at:

http://meego.zimmerle.org/repo/security/

If you are interested in testing it by yourself, you can download my ks file here.

That kind of protection is very important almost mandatory, modern system still been hacked by such kind of attack class, when they opt to not provide such protection, the case of Xbox, for example which is exposed to a vulnerability in the 007: Agent Under Fire (http://en.wikipedia.org/wiki/Agent_Under_Fire_(video_game)).

Poulsbo support on MeeGo, almost there

This is a continuation of my last post about Poulsbo support on MeeGo. A lot of people have asked me to continue this work, but I just had time today. In this post I will talk about the Xorg drivers. After some research/reading these sites:

• http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/cooker/x11-driver-video-psb/


• http://code.google.com/p/gma500/


• http://www.happyassassin.net/2010/05/21/video-acceleration-and-poulsbo-news/


• https://edge.launchpad.net/~gma500/+archive/fix

And after some work, I created/built the necessary packages to get the Poulsbo Xorg driver working on MeeGo. The performance differences are notable.

I got my netbook running MeeGo with the Xorg driver, but without 3D acceleration yet, meaning, it still slow. The Intel closed 3D driver is already packed and installed but for an unknown reason when I enable it the Xorg just crash. Further investigation is needed.

I had to place “suid” bit on Xorg to make the driver work correctly. All the necessary packages to make it work can be found on my megoo repo, and also there is an image available if you want to check it out.

You can download the image via torrent or directly from my site: iso image. The ks file goes here.

And here is a nice picture of my netbook running the MeeGo official UI:

[Update 2016-12-26] Mandriva's svn repositories are no longer available. For further information check (external link): http://www.whoishostingthis.com/resources/mandriva/

MeeGo: @SELinux on %packages.

I finally bought a netbook and since I am intending to use it with some work stuff (meaning data that requires confidentiality and integrity) I started to tuning my MeeGo to make it more protected before place my data

To make it more protected I think that it is interesting to confine some, let’s say, “untrusted applications”. Which basically means more restrictive control over the processes. Usually I use GRSecurity for that but this time I am using SELinux. Since I am dealing with RPM and Fedora use to be a reference (at least for me) in the support to the SELinux, most of the specs files were copied from Fedora including the policy. The policy should be well refined to fit my needs, but it will be the subject of another post.

Supporting SELinux involves to support not only the kernel part of SELinux (kernel-selinux-netbook), but to support a huge number of packages as you can see bellow:

• selinux-policy-targeted
• selinux-policy-doc
• bwidget
• selinux-policy
• setools-libs-python
• setools-libs
• libsepol
• kernel-selinux-netbook
• libselinux-ruby
• ustr-debug
• policycoreutils
• libprelude-python
• libprelude-perl
• policycoreutils-python
• pax-utils
• audispd-plugins
• libselinux
• perf
• policycoreutils-newrole
• libprelude-ruby
• checkpolicy
• ustr-debug-static
• audit-libs-python
• libsemanage-static
• setools
• libsemanage-python
• ustr
• libselinux-static
• audit-libs
• libsemanage
• setools-libs-tcl
• libsepol-static
• setools-console
• libselinux-python
• ustr-static
• libprelude
• libselinux-utils
• audit

Part of these packages are not needed to make the SELinux work, but they are used by auxiliary applications which make SELinux easy to deal with. As you can see, these packages provide dependencies on Ruby, Perl and Python for example. I think we just need the python dependency. The big difference between my packages and Fedora’s packages is the fact that I refuse myself to port the Java SELinux utilities.

All the support to that packages (and also the devel version of them) are available at my MeeGo repo at:

http://meego.zimmerle.org/repo/security/packages/

To add SELinux to your image, you just need to add to your .ks file, the following repo:

repo --name=security --baseurl=http://meego.zimmerle.org/repo/security/packages/

And you also need to place the SELinux package group in the package section:

@SELinux

kernel-selinux-notebook

An example of a kick start file can be downloaded here: http://meego.zimmerle.org/repo/security/build/meego-netbook-chromium-ia32-security-1.0.20100614.1459.ks

You can also download a SELinux MeeGo image at: http://meego.zimmerle.org/repo/security/build/

Here goes a picture of my netbook running selinux kernel:

The policy is not loaded automatically after the boot and the file system is not labeled yet. To load the policy just use load_policy tool.

4×4 inclinometer

For those who are interested in knowing how steep is your N900, or the object that supports it. Meet the 4×4 inclinometer.

I developed it to use in my car, hence the name 4×4 inclinometer. Using this application I can know the slope of the obstacles or the ground below my car.

According to the manual of the car, it can be in an angle of heel of 45 degrees with no problem, something higher than this is at my own risk. When I read this information, just imagined the software for the N900)

The current version depends on Qt 4.6 with the animation framework. The animation is used to rotate the images of the car, smoothing the movement. I am not an expert in gimp, so forgive me for the images poorly done. Next version I will put a simple support for themes.

The intallation files are already in extras-devel, so you just need to apt-get it. And the sources are available at:

http://git.zimmerle.org/?p=inclinometer.git;a=summary

The car image and the application background are Trademark of Troller Veiculos Especias S/A, http://www.troller.com.br

Poulsbo @MeeGo

While I was trying to leave my MeeGo usable and secure, the need to put my video driver to work properly appeared because I was getting annoyed with the fact that I haven’t the “official” MeeGo Ui running yet.

The chipset is a Poulsbo. It is in the list of not supported hardwares on MeeGo (http://wiki.meego.com/Netbooks), but, somehow Mandriva and others distros make use of it, so I decide to take a look by my self.

The posts from Adam Williamson (http://www.happyassassin.net/2009/01/30/intel-gma-500-poulsbo-graphics-on-linux-a-precise-and-comprehensive-summary-as-to-why-youre-screwed/) were very useful and based on that I decided to take a look at Mandriva’s svn (http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/cooker/libdrm-psb/), just to try to port something that already exists to MeeGo platform.

Another good resource is: https://edge.launchpad.net/~gma500/+archive/fix

With all that information I started to port the packages to MeeGo, creating the rpm specs in order to generate the packages. I did not have time to finish all packages yet, the Xorg driver is still missing. The kernel driver and others required packages are available on my MeeGo repo. It means good framebuffer screen and cool Xfce session, but not MeeGo UI yet.

A new Kernel is required to be installed since happened a conflict or something like that with another module which was compiled built-in in the official Kernel. As I said, the Xorg driver is still missing. I will work on that as soon as I find some time to do it.

The packages are available on my MeeGo repo, at: http://meego.zimmerle.org/repo/psb/packages/

The packages are:

• psb-firmware
• psb-kernel-modules
• kernel-netbook-psb
• psb-kernel-source
• kernel-netbook-psb-devel

tcpdump && lipcap on extras-devel

For those who are playing with Maemo and network, now are available at Maemo extras-devel {fremantle|diablo} the tcpdump package and its dependency (libpcap) working like a charm.

Iptables on extras devel

The iptables package is on Maemo extras devel. There is no support for connection state on the device Kernel consequently the NAT is not working. I tried to compile the modules, but I found myself in trouble trying to load them at the device. If you want to flash a kernel with support for connection state there is one available at my personal repository (read: mWall :: netfilter + ui for maemo for more information). Another discussion about that modules can be found: here.