NAME

       paxtest — program to test buffer overflow protection

SYNOPSIS

       paxtest [kiddie|blackhat]  [logfile]

DESCRIPTION

       paxtest  is  a  program that attempts to test kernel enforcements over memory usage. Some attacks benefit
       from kernels that do not impose limitations. For example, execution in some memory segments makes  buffer
       overflows  possible.  It  is  used  as a regression test suite for PaX, but might be useful to test other
       memory protection patches for the kernel.

       paxtest runs a set of programs that attempt to subvert memory usage. For example:

       Executable anonymous mapping             : Killed
       Executable bss                           : Killed
       Executable data                          : Killed
       Executable heap                          : Killed
       Executable stack                         : Killed
       Executable anonymous mapping (mprotect)  : Killed
       Executable bss (mprotect)                : Killed
       Executable data (mprotect)               : Killed
       Executable heap (mprotect)               : Killed
       Executable shared library bss (mprotect) : Killed
       Executable shared library data (mprotect): Killed
       Executable stack (mprotect)              : Killed
       Anonymous mapping randomisation test     : 16 bits (guessed)
       Heap randomisation test (ET_EXEC)        : 13 bits (guessed)
       Heap randomisation test (ET_DYN)         : 25 bits (guessed)
       Main executable randomisation (ET_EXEC)  : No randomisation
       Main executable randomisation (ET_DYN)   : 17 bits (guessed)
       Stack randomisation test (SEGMEXEC)      : 23 bits (guessed)
       Stack randomisation test (PAGEEXEC)      : 24 bits (guessed)
       Return to function (strcpy)              : Vulnerable
       Return to function (strcpy, RANDEXEC)    : Vulnerable
       Return to function (memcpy)              : Vulnerable
       Return to function (memcpy, RANDEXEC)    : Vulnerable
       Executable shared library bss            : Killed
       Executable shared library data           : Killed
       Writable text segments                   : Killed

       The ``Executable ...'' tests basically put an instruction in a place that is supposed to  be  data  (i.e.
       malloced  data,  C  variable,  etc.)   and tries to execute it. The ``(mprotect)'' tests try to trick the
       kernel in marking this piece of memory as executable first.   Return  to  function  tests  overwrite  the
       return  address  on  the stack, these are hard to prevent from inside the kernel.  The last test tries to
       overwrite memory which is marked as executable.

       A normal Linux kernel (unpatched to protect for buffer overflows) will show all tests as  Vulnerable  and
       no  stack  randomisation or 6 bits (due to stack colouring). In other words, on a normal Linux kernel you
       can execute any data inside a process's memory or overwrite any code at will.

       This manual page was written for the Debian distribution because the original program  does  not  have  a
       manual page.

OPTIONS

       This  program can take two options: the tests to run, which are indicated using either kiddie or blackhat
       and (optionally) a file to which log all the test results. By default it will  log  to  the  user's  HOME
       directory in a paxtest.log file.

SEE ALSO

       For more information see PaX Documentation (link to URL http://pax.grsecurity.net/docs) .

AUTHOR

       paxtest was written by Peter Busser.

       This  manual  page was written by Javier Fernandez-Sanguino jfs@debian.org for the Debian system (but may
       be used by others) based on the information in the source code and Peter Busser's comments sent to public
       mailing  lists.  Permission is granted to copy, distribute and/or modify this document under the terms of
       the GNU Public License, Version 2 or any later version published by the Free Software Foundation.

                                                                                                      PAXTEST(1)