I probably should add, this will solve only Steam run issue. To run games, they also should be fixed in same way. For example:
paxctl -Cm "/home/powerman/.local/share/Steam/SteamApps/common/World of Goo/WorldOfGoo"
paxctl -Cm /home/powerman/.local/share/Steam/SteamApps/common/Uplink/uplink.bin.x86_64
I've just noticed gameoverlayui (in same dir as steam binary) also should be paxmarked. Actually, it works ok without this, but I see errors in logs:
2012-12-22_01:20:37.35360 kern.alert: grsec: denied RWX mprotect of /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui.so by /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui[MainThrd:9050] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:8991] uid/euid:1000/1000 gid/egid:1000/1000
2012-12-22_01:20:37.35363 kern.info: MainThrd[9050]: segfault at 204 ip 00000000e69a1d4d sp 00000000f41c0320 error 4 in ld-2.15.so[e698d000+1e000]
2012-12-22_01:20:37.35363 kern.alert: grsec: Segmentation fault occurred at 0000000000000204 in /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui[MainThrd:9050] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:8991] uid/euid:1000/1000 gid/egid:1000/1000
Workarounds mentioned above doesn't enough anymore (looks like latest steam update changed way to run games).
Since kernel 3.9.5 we can migrate from PT_PAX to XATTR_PAX, so paxmarking (using new paxctl-ng tool) doesn't modify binaries anymore, and thus doesn't conflict with steam (and some games) consistency check.
To run steam we still need to paxctl-ng -m steam binary, and same for games binaries. But in current steam version this result in ability to run steam client and manually run games (from command line), but games can't be run from steam interface!
Problem is, steam now run games in this way:
LD_LIBRARY_PATH=… LD_PRELOAD=:gameoverlayrenderer.so sh -c "/path/to/game"
this result in attempt to load gameoverlayrenderer.so in sh process, which fail with
$ LD_LIBRARY_PATH=… LD_PRELOAD=:gameoverlayrenderer.so sh
sh: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted
kern.alert: grsec: denied RWX mmap of /usr/lib64/opengl/nvidia/lib/libGL.so.319.23 by /bin/bash[sh:16425] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:15657] uid/euid:1000/1000 gid/egid:1000/1000
To fix it we have to paxctl-ng -m /bin/bash which doesn't looks good. :(
paxctl-ng -m /bin/bash ~/.local/share/Steam/ubuntu12_32/steam ~/.local/share/Steam/ubuntu12_32/gameoverlayui does not allow steam to run for me. has there been a recent update that caused it to fail?
ah, the 'paxctl-ng -m /bin/bash' causes bash to fail to run :D
Hi, I'm also using a Gentoo 64-bit Hardened system.
Like noted before, the migration to XATTR flags solved the modification of binaries issue.
PAX-marking the steam binary and a games' executable (like hl2_linux for CS Source) was enough to get it running from the interface and from the link on my desktop, which uses the steam-url.
However, I'm using an Intel HD graphics card for that, maybe this issue is related to the nvidia binary driver.
I hope, these observations help in some way.
I'm on intel as well :P
Whether this is steam's fault or some missunderstanding this is the worst possible way of preloading a library and basically a bug waiting to happen as you are preloading the library for sh which may depend on symbols being overwritten by the preloaded library
The most appropriate way would be something along these lines:
sh -c 'export "LD_LIBRARY_PATH=…" "LD_PRELOAD=$LD_PRELOAD:gameoverlayrenderer.so"; "/path/to/game"'
Being careful to escape single quotes inside the paths if any.
An even cleaner way would be this:
sh -c 'export "LD_LIBRARY_PATH=…" "LD_PRELOAD=$LD_PRELOAD:gameoverlayrenderer.so"; exec "/path/to/game"'
And of course the best way would involve just using fork and execve modifying the environment variable list being passed.
Still an issue, using this to make it work with PaX atm:
paxctl-ng -m ~/.config/Steam/ubuntu12_32/{steam,steamwebhelper,gameoverlayui}
This would be fixed relatively easy by allowing users to add hooks (e,g, via an env var or in folders) at specific points in the wrapper scripts.
Sufficient would probably be before starting/restarting steam for the moment, just to be able to start steam in the first place.
Nothing extracted yet.
I'm using 64-bit Gentoo Hardened. I've successfully installed Steam, but it fail to run because of incompatibility with PaX. (Gentoo Hardened uses linux kernel patched with GrSecurity which includes PaX.)
In ideal world you should make Steam compatible with PaX, because it doesn't need to execute dynamic code like virtual machines so it can be compatible with PaX and thus more secure. But we're not in ideal world, so only thing I ask you is mark your executable using
paxctl -Cm- that's enough to let it run on PaX-protected kernel.I've tried to patch your sh scripts to run
paxctl -Cmbefore starting binary application, but this just results in endless loop of updating Steam (probably because it detect some changes in it files).Finally, I was able to work around this by running this script in background while steam was updating:
but this code can fail because of race condition and steam probably will need to be fixed this way again on next update, so this solution isn't ease to use.
Here is what I get in kernel logs without
paxctl -Cm: