REVDEP-PAX
Section: Documentation for elfix (1)
Updated: 2018-12-13
Page Index
NAME
revdep-pax - find mismatching PaX markings between ELF objects and their libraries
SYNOPSIS
revdep-pax -f [-v]
revdep-pax -r [-ve]
revdep-pax -b OBJECT [-myv]
revdep-pax -s SONAME [-myve]
revdep-pax -l LIBRARY [-myve]
revdep-pax [-h]
DESCRIPTION
revdep-pax finds mismatching PaX markings between an
ELF object and the
libraries which that object dynamically links against. When executing an
ELF
binary that links against libraries, the PaX hardened kernel ignores the libraries'
markings and uses the executable's markings to enforce PaX restrictions.
It is desireable in some circumstances to reverse migrate a library's markings
to the binaries that link against it.
revdep-pax can either forward migrate PaX markings from an ELF object to its
libraries, or reverse migrate from a library to all the objects that link
against it. The library can either be specified by its SONAME as it is reported
by ldd(1), or by the full path to the LIBRARY file. Symbolic links are
dereferenced. The user can optionally scan for all forward mappings on the
system (-f), for all reverse mappings (-r), for forward mappings of just one
OBJECT (-b), for reverse mappings of just one SONAME (-s) or one LIBRARY (-l).
In verbose mode (-v), all mappings are reported, not just mismatching ones,
and in mark mode (-m), the user is prompted whether to proceed with the migration,
so that the PaX flags of the target inherit the flags of the source.
OPTIONS
- -f Scan the system for all forward mappings.
-
- -r Scan the system for all reverse mappings.
-
- -b OBJECT Retrieve only the forward mappings for this ELF OBJECT.
-
- -s SONAME Retrieve only the reverse mappings for this SONAME.
-
- -l LIBRARY Retrieve only the reverse mappings for this LIBRARY.
-
- -v Report all mappings, not just the mismatched ones.
-
- -e Limit the markings or report to only those executables in the current shell's $PATH.
-
- -m Prompt the user to mark the found object with the PaX flags of the source.
-
- -y Assume "yes" to all prompts for marking (USE CAREFULLY!)
-
- -h Print out a short help message and exit.
-
HOMEPAGE
http://www.gentoo.org/proj/en/hardened/pax-quickstart.xml
REPORTING BUGS
Please report bugs at
http://bugs.gentoo.org.
SEE ALSO
scanelf(1),
dumpelf(1),
paxctl(1),
pspax(1),
fix-gnustack(1),
ldd(1)
AUTHORS
Anthony G. Basile <
blueness@gentoo.org>