# hardened / pax with 3D acceleration / compiz (3D-desktop) ?

## kernelOfTruth

Hi ladies & gentlemen,

is there a possibility to run pax / hardened gentoo with 3D acceleration ? (I'm sure there's a way   :Sad:  )

but this might turn out to be a long way in the end, so:

- what libraries do I need to change permissions of?

- ditto for the libraries of compiz ...

many thanks in advance   :Smile: 

even glxgears isn't running atm, so you'll get the an idea on how "secure" my rig is right now   :Laughing: 

 *Quote:*   

> [  725.288573] PAX: execution attempt in: /usr/lib64/opengl/nvidia/lib/libGLcore.so.169.12, 346205a12000-346205b85000 0093d000
> 
> [  725.288578] PAX: terminating task: /usr/bin/glxinfo(glxinfo):6119, uid/euid: 0/0, PC: 0000346205ad38d0, SP: 00007f9bf3038c18
> 
> [  725.288581] PAX: bytes at PC: 64 48 8b 04 25 60 ff ff ff ff a0 10 08 00 00 cc cc cc cc cc 
> ...

 

just for the record:

getting mono to work / install: https://forums.gentoo.org/viewtopic-t-578155-highlight-.html?sid=aea66047bf66915759480073d30c7fcb

getting tomboy / f-spot to work: https://forums.gentoo.org/viewtopic-t-551723-highlight-chpax.html?sid=7d77a44766d85b6c65fd97c818c583f5

----------

## Sadako

IIRC, both the nvidia and ati proprietary binary drivers are hard masked on the hardened profiles, so good bloody luck with this.

 :Razz: 

I've used compiz and other accelerated 3d stuff just fine on hardened, but that was with a radeon 9250 and the open source r200 drivers.

Have you played around with paxctl on the nvidia gl libs?

----------

## kernelOfTruth

 *Hopeless wrote:*   

> IIRC, both the nvidia and ati proprietary binary drivers are hard masked on the hardened profiles, so good bloody luck with this.
> 
> I've used compiz and other accelerated 3d stuff just fine on hardened, but that was with a radeon 9250 and the open source r200 drivers.
> 
> Have you played around with paxctl on the nvidia gl libs?

 

yes, that's currently what I'm doing & still no luck ^^

at least glxgears launches & is killed in an instant whereas before it wouldn't even show up    :Surprised: 

so security / pax and 3D isn't impossible, as written in the gentoo docs, eh ?   :Wink: 

----------

## kernelOfTruth

even in softmode it's better than without   :Very Happy: 

 *Quote:*   

> Executable anonymous mapping             : Killed
> 
> Executable bss                           : Killed
> 
> Executable data                          : Killed
> ...

 

so I guess I'll switch to softmode if I feel the urge to run candy & am not connected to the net etc etc.

hopefully someone will show up & posting how to get compiz running in non-softmode   :Razz: 

 *Quote:*   

> I've used compiz and other accelerated 3d stuff just fine on hardened, but that was with a radeon 9250 and the open source r200 drivers. 

 

*sigh* if only nvidia would open-source their graphics drivers   :Rolling Eyes: 

----------

## wyv3rn

Nvidia-driver's closed-source libraries and binaries are non-PIC, so anything that uses them (3D apps) will need MPROTECT turned off.  You can manage the flags for this with paxctl (for anything built with gentoo toolchain) and chpax (deprecated, for binaries not built with hardened toolchain).  You will need to emerge paxctl and chpax.  Then use them as so:

paxctl -m /usr/bin/glxinfo

Now you should be able to run glxinfo.  This is why nvidia-drivers are masked on hardened.  Open source drivers typically don't give these problems.

----------

