Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1632412 - checksec --kernel shows GCC stack protector support: Disabled when the kernel configuration has the strong stack protector enabled
Summary: checksec --kernel shows GCC stack protector support: Disabled when the kernel...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: checksec
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Robin Lee
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-09-24 17:56 UTC by Matt Fagnani
Modified: 2018-10-07 22:15 UTC (History)
2 users (show)

Fixed In Version: checksec-1.8.0-2.fc29 checksec-1.8.0-2.fc27 checksec-1.8.0-2.fc28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-07 20:58:33 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Matt Fagnani 2018-09-24 17:56:51 UTC
Description of problem:
When I ran sudo checksec --kernel with checksec 1.8.0 I got the following

* Kernel protection information:

  Description - List the status of kernel protection mechanisms. Rather than
  inspect kernel mechanisms that may aid in the prevention of exploitation of
  userspace processes, this option lists the status of kernel configuration
  options that harden the kernel itself against attack.

  Kernel config:
/boot/config-4.18.9-200.fc28.i686

  Warning: The config on disk may not represent running kernel config!

  Vanilla Kernel ASLR:                    Full
  Protected symlinks:                     Enabled
  Protected hardlinks:                    Enabled
  Ipv4 reverse path filtering:            Enabled
  Ipv6 reverse path filtering:            Disabled
  Kernel heap randomization:              Enabled
  GCC stack protector support:            Disabled
  Enforce read-only kernel data:          Enabled
  Enforce read-only module data:          Enabled
  Hardened Usercopy:                      Enabled
  Hardened Usercopy Pagespan:           Disabled
  Restrict /dev/mem access:               Enabled
  Restrict /dev/kmem access:              Enabled

* SELinux:                                Enforcing
  Checkreqprot:                           Enabled
  Deny Unknown:                           Disabled

* grsecurity / PaX:                       No GRKERNSEC

  The grsecurity / PaX patchset is available here:
    http://grsecurity.net/

That output shows GCC stack protector support: Disabled while the kernel configuration file /boot/config-4.18.9-200.fc28.i686 has the GCC strong stack protector enabled as shown in the following lines from that file
CONFIG_HAVE_STACKPROTECTOR=y
CONFIG_CC_HAS_STACKPROTECTOR_NONE=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y

checksec-1.7.4-6.fc28 also showed GCC stack protector support: Disabled.

Version-Release number of selected component (if applicable):
checksec-0:1.8.0-1.fc28.noarch
kernel-0:4.18.9-200.fc28.i686

How reproducible:
Each time I've tried it

Steps to Reproduce:
1. sudo checksec --kernel
2. less /boot/config-4.18.9-200.fc28.i686
3.

Actual results:
GCC stack protector support: Disabled

Expected results:
GCC stack protector support: Enabled

Additional info:

Comment 1 Fedora Update System 2018-09-27 01:50:24 UTC
checksec-1.8.0-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-428ab52499

Comment 2 Fedora Update System 2018-09-27 01:50:42 UTC
checksec-1.8.0-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-428ab52499

Comment 3 Fedora Update System 2018-09-27 01:51:33 UTC
checksec-1.8.0-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-f7fc85454e

Comment 4 Fedora Update System 2018-09-27 01:51:47 UTC
checksec-1.8.0-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-f7fc85454e

Comment 5 Fedora Update System 2018-09-27 01:53:00 UTC
checksec-1.8.0-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-6994b7f66c

Comment 6 Fedora Update System 2018-09-27 01:53:14 UTC
checksec-1.8.0-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-6994b7f66c

Comment 7 Fedora Update System 2018-09-27 16:41:16 UTC
checksec-1.8.0-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-f7fc85454e

Comment 8 Fedora Update System 2018-09-27 17:09:29 UTC
checksec-1.8.0-2.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-6994b7f66c

Comment 9 Fedora Update System 2018-09-27 18:41:16 UTC
checksec-1.8.0-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-428ab52499

Comment 10 Fedora Update System 2018-10-07 20:58:33 UTC
checksec-1.8.0-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2018-10-07 21:11:24 UTC
checksec-1.8.0-2.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2018-10-07 22:15:22 UTC
checksec-1.8.0-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.