paxtest results

wiki/src/blueprint/kernel_hardening.mdwn

 [[!meta title="Linux kernel hardening"]]
 
-(To be done.)
+The GNU/Linux kernel is currently a stock Debian GNU/Linux kernel. Using the paxtest tool, we can test techniques for exploitation. The default kernel without grsec is less than secure but we should never do worse than what is currently documented on this page. With each release of Tails, we should update this page.
 
+
+    The Amnesic Incognito Live System
+
+    Build information:
+    1.0 - 20140427
+    2cb0ccacbf3cffde533cb09699b6b8e916b89c2d
+    live-build: 2.0.12-2
+    live-boot: 3.0.1-1
+    live-config: 3.0.23-1
+
+    uname -a;paxtest kiddie
+    Linux amnesia 3.12-1-amd64 #1 SMP Debian 3.12.9-1 (2014-02-01) x86_64 GNU/Linux
+    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
+    Released under the GNU Public Licence version 2 or later
+
+    Writing output to paxtest.log
+    It may take a while for the tests to complete
+    Test results:
+    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
+    Released under the GNU Public Licence version 2 or later
+
+    Mode: kiddie
+    Linux amnesia 3.12-1-amd64 #1 SMP Debian 3.12.9-1 (2014-02-01) x86_64 GNU/Linux
+
+    Executable anonymous mapping             : Killed
+    Executable bss                           : Killed
+    Executable data                          : Killed
+    Executable heap                          : Killed
+    Executable stack                         : Killed
+    Executable anonymous mapping (mprotect)  : Vulnerable
+    Executable bss (mprotect)                : Vulnerable
+    Executable data (mprotect)               : Vulnerable
+    Executable heap (mprotect)               : Vulnerable
+    Executable shared library bss (mprotect) : Vulnerable
+    Executable shared library data (mprotect): Vulnerable
+    Executable stack (mprotect)              : Vulnerable
+    Anonymous mapping randomisation test     : 9 bits (guessed)
+    Heap randomisation test (ET_EXEC)        : 13 bits (guessed)
+    Heap randomisation test (ET_DYN)         : 16 bits (guessed)
+    Main executable randomisation (ET_EXEC)  : 10 bits (guessed)
+    Main executable randomisation (ET_DYN)   : 10 bits (guessed)
+    Shared library randomisation test        : 10 bits (guessed)
+    Stack randomisation test (SEGMEXEC)      : 19 bits (guessed)
+    Stack randomisation test (PAGEEXEC)      : 19 bits (guessed)
+    Return to function (strcpy)              : Vulnerable
+    Return to function (strcpy, RANDEXEC)    : Vulnerable
+    Return to function (memcpy)              : Vulnerable
+    Return to function (memcpy, RANDEXEC)    : Vulnerable
+    Executable shared library bss            : Killed
+    Executable shared library data           : Killed
+    Writable text segments                   : Vulnerable
+
+    amnesia@amnesia:~$ uname -a;paxtest blackhat
+    Linux amnesia 3.12-1-amd64 #1 SMP Debian 3.12.9-1 (2014-02-01) x86_64 GNU/Linux
+    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
+    Released under the GNU Public Licence version 2 or later
+
+    Writing output to paxtest.log
+    It may take a while for the tests to complete
+    Test results:
+    PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@adamantix.org>
+    Released under the GNU Public Licence version 2 or later
+
+    Mode: blackhat
+    Linux amnesia 3.12-1-amd64 #1 SMP Debian 3.12.9-1 (2014-02-01) x86_64 GNU/Linux
+
+    Executable anonymous mapping             : Killed
+    Executable bss                           : Killed
+    Executable data                          : Killed
+    Executable heap                          : Killed
+    Executable stack                         : Killed
+    Executable anonymous mapping (mprotect)  : Vulnerable
+    Executable bss (mprotect)                : Vulnerable
+    Executable data (mprotect)               : Vulnerable
+    Executable heap (mprotect)               : Vulnerable
+    Executable shared library bss (mprotect) : Vulnerable
+    Executable shared library data (mprotect): Vulnerable
+    Executable stack (mprotect)              : Vulnerable
+    Anonymous mapping randomisation test     : 9 bits (guessed)
+    Heap randomisation test (ET_EXEC)        : 13 bits (guessed)
+    Heap randomisation test (ET_DYN)         : 16 bits (guessed)
+    Main executable randomisation (ET_EXEC)  : 10 bits (guessed)
+    Main executable randomisation (ET_DYN)   : 10 bits (guessed)
+    Shared library randomisation test        : 10 bits (guessed)
+    Stack randomisation test (SEGMEXEC)      : 20 bits (guessed)
+    Stack randomisation test (PAGEEXEC)      : 19 bits (guessed)
+    Return to function (strcpy)              : Vulnerable
+    Return to function (strcpy, RANDEXEC)    : Vulnerable
+    Return to function (memcpy)              : Vulnerable
+    Return to function (memcpy, RANDEXEC)    : Vulnerable
+    Executable shared library bss            : Killed
+    Executable shared library data           : Killed
+    Writable text segments                   : Vulnerable