Re: Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-06 Thread Joerg Sonnenberger
On Tue, Jul 05, 2016 at 06:31:17PM +0100, Jonathan Perkin wrote: > Then name them PAX_MPROTECT_SKIP and PAX_ASLR_SKIP to follow > CHECK_SHLIBS_SKIP, CHECK_INTERPRETER_SKIP, etc? That name isn't very helpful in that it doesn't say what the default action is. A better name would be something like PA

Re: Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-05 Thread David A. Holland
On Tue, Jul 05, 2016 at 06:52:56PM +0200, Thomas Klausner wrote: > > then there's agc's objection to negative boolean variables, which I > > tend to agree with; instead of [snip] > > But it's not a yes/no variable, it's a list of files. er, I think I knew that at some point... although makin

Re: Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-05 Thread Jonathan Perkin
* On 2016-07-05 at 17:53 BST, Thomas Klausner wrote: > On Tue, Jul 05, 2016 at 04:46:15PM +, David Holland wrote: > > I don't remember if I mentioned this somewhere before or only thought > > it, but: > > > > On Tue, Jul 05, 2016 at 06:39:12PM +0200, Leonardo Taccari wrote: > > > Add NOT_PAX

Re: Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-05 Thread Thomas Klausner
On Tue, Jul 05, 2016 at 04:46:15PM +, David Holland wrote: > I don't remember if I mentioned this somewhere before or only thought > it, but: > > On Tue, Jul 05, 2016 at 06:39:12PM +0200, Leonardo Taccari wrote: > > Add NOT_PAX_ASLR_SAFE and NOT_PAX_MPROTECT_SAFE to BUILD_DEFS so the > > pax

Re: Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-05 Thread David Holland
I don't remember if I mentioned this somewhere before or only thought it, but: On Tue, Jul 05, 2016 at 06:39:12PM +0200, Leonardo Taccari wrote: > Add NOT_PAX_ASLR_SAFE and NOT_PAX_MPROTECT_SAFE to BUILD_DEFS so the > paxctl-fied binaries can be inspected via `pkg_info -Q' while PAX_MPROTECT is

Some pkgsrc/mk/pax.mk suggestions (was: Re: PaX mprotect now on for amd64)

2016-07-05 Thread Leonardo Taccari
Hello Pierre and tech-pkg@! (moving the discussion to tech-pkg@ where is more appropriate) Pierre Pronchery writes: > I wrote this mini-framework for paxctl(8) in pkgsrc: > > http://git.edgebsd.org/gitweb/?p=edgebsd-pkgsrc.git;a=commitdiff;h=f1354300f9d734202bd0ce49b33d74f455aea9e1 > > and addre