REVDEP-PAX

Section: Documentation for elfix (1)
Updated: 2015-10-27
Index Return to Main Contents

NAME

revdep-pax - find mismatching PaX markings between ELF objects and their libraries

SYNOPSIS

revdep-pax -f [-v]

revdep-pax -r [-ve]

revdep-pax -b OBJECT [-myv]

revdep-pax -s SONAME [-myve]

revdep-pax -l LIBRARY [-myve]

revdep-pax [-h]

DESCRIPTION

revdep-pax finds mismatching PaX markings between an ELF object and the libraries which that object dynamically links against. When executing an ELF binary that links against libraries, the PaX hardened kernel ignores the libraries' markings and uses the executable's markings to enforce PaX restrictions. It is desireable in some circumstances to reverse migrate a library's markings to the binaries that link against it.

revdep-pax can either forward migrate PaX markings from an ELF object to its libraries, or reverse migrate from a library to all the objects that link against it. The library can either be specified by its SONAME as it is reported by ldd(1), or by the full path to the LIBRARY file. Symbolic links are dereferenced. The user can optionally scan for all forward mappings on the system (-f), for all reverse mappings (-r), for forward mappings of just one OBJECT (-b), for reverse mappings of just one SONAME (-s) or one LIBRARY (-l). In verbose mode (-v), all mappings are reported, not just mismatching ones, and in mark mode (-m), the user is prompted whether to proceed with the migration, so that the PaX flags of the target inherit the flags of the source.

OPTIONS

-f Scan the system for all forward mappings.
-r Scan the system for all reverse mappings.
-b OBJECT Retrieve only the forward mappings for this ELF OBJECT.
-s SONAME Retrieve only the reverse mappings for this SONAME.
-l LIBRARY Retrieve only the reverse mappings for this LIBRARY.
-v Report all mappings, not just the mismatched ones.
-e Limit the markings or report to only those executables in the current shell's $PATH.
-m Prompt the user to mark the found object with the PaX flags of the source.
-y Assume yes to all prompts for marking (USE CAREFULLY!)
-h Print out a short help message and exit.