Re: [gentoo-hardened] Running Skype on Hardened

[Ђорђе Тодоровић]

On Thu, 29 Mar 2012, Sven Vermeulen wrote:

You can try to make it a valid ELF header first, and then paxmark it.

I have the following for my Skype:
paxctl -C /opt/skype/skype
paxctl -me /opt/skype/skype

I tried running paxctl -Cm on it (should be ran on install with pax_kernel USE
flag), by it still reports an invalid ELF executable.

This is listed in the ebuld:

if use pax_kernel; then
    pax-mark Cm "${D}"/opt/skype/skype || die
    eqawarn "You have set USE=pax_kernel meaning that you intend to run"
    eqawarn "skype under a PaX enabled kernel.  To do so, we must modify"
    eqawarn "the skype binary itself and this *may* lead to breakage!  If"
    eqawarn "you suspect that skype is being broken by this modification,"
    eqawarn "please open a bug."
fi

BTW,I checked the skype changelog and this was added recently:
    29 Feb 2012; mthode <mth...@gentoo.org> skype-2.2.0.35-r1.ebuild:
    fix the paxmarking syntax

    paxmarked m skype to work on hardened


But it somehow fails to complete on my machine when I try it manually.
I also just checked, my current profile is multilib (I said earlier no-mulitlib)

I seriously am not sure if it is of any help,but attached the ELF header of the
skype executable (/opt/skype/skype) so maybe (IDK) someone can tell if

file /opt/skype/skype says:
/opt/skype/skype: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), stripped


--
 . O . | Djordje Todorovic    [http://barabbas.github.com] | O . O
 . . O | GPG-Key: 2048R/1E133339      (http://pgp.mit.edu) | . O O
 O O O | BFF2 1C7F A70D ECCD FA8F C946 DB32 B498 1E13 3339 | . O .

28 Feb 2012; mthode <mth...@gentoo.org> skype-2.2.0.35-r1.ebuild: there is an obvious problem there.

skype_ELF_header.tar.bz
Description: application/bzip

signature.asc
Description: Digital signature