protonscr

Compatibility with PaX/GrSecurity

steamopen Feature Requestreviewed
ValveSoftware/steam-for-linux#254 · opened 2012-12-22 by powerman · updated 2019-07-18 · 11 comments · github
Ppowerman 2012-12-22 github

I'm using 64-bit Gentoo Hardened. I've successfully installed Steam, but it fail to run because of incompatibility with PaX. (Gentoo Hardened uses linux kernel patched with GrSecurity which includes PaX.)

In ideal world you should make Steam compatible with PaX, because it doesn't need to execute dynamic code like virtual machines so it can be compatible with PaX and thus more secure. But we're not in ideal world, so only thing I ask you is mark your executable using paxctl -Cm - that's enough to let it run on PaX-protected kernel.

I've tried to patch your sh scripts to run paxctl -Cm before starting binary application, but this just results in endless loop of updating Steam (probably because it detect some changes in it files).

Finally, I was able to work around this by running this script in background while steam was updating:

while :; do
    F=~/.local/share/Steam/ubuntu12_32/steam
    cp $F{,.new}
    paxctl -Cm $F.new
    mv $F{.new,}
done

but this code can fail because of race condition and steam probably will need to be fixed this way again on next update, so this solution isn't ease to use.

Here is what I get in kernel logs without paxctl -Cm:

2012-12-21_20:55:20.46245 kern.alert: grsec: denied RWX mprotect of /home/powerman/.local/share/Steam/ubuntu12_32/crashhandler.so by /home/powerman/.local/share/Steam/ubuntu12_32/steam[MainThrd:10300] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/steam.sh[steam.sh:10201] uid/euid:1000/1000 gid/egid:1000/1000
2012-12-21_20:55:20.46344 kern.alert: grsec: denied RWX mmap of /usr/lib32/opengl/nvidia/lib/libGL.so.304.64 by /home/powerman/.local/share/Steam/ubuntu12_32/steam[MainThrd:10300] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/steam.sh[steam.sh:10201] uid/euid:1000/1000 gid/egid:1000/1000
2012-12-21_20:55:20.54547 kern.alert: grsec: denied RWX mprotect of /lib32/ld-2.15.so by /home/powerman/.local/share/Steam/ubuntu12_32/steam[MainThrd:10300] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/steam.sh[steam.sh:10201] uid/euid:1000/1000 gid/egid:1000/1000
2012-12-21_20:55:20.54549 kern.info: MainThrd[10300]: segfault at f2acfec4 ip 00000000f2ab8485 sp 00000000fce509f0 error 7 in ld-2.15.so[f2ab1000+1e000]
2012-12-21_20:55:20.54549 kern.alert: grsec: Segmentation fault occurred at 00000000f2acfec4 in /home/powerman/.local/share/Steam/ubuntu12_32/steam[MainThrd:10300] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/steam.sh[steam.sh:10201] uid/euid:1000/1000 gid/egid:1000/1000
Ppowerman 2012-12-22 github

I probably should add, this will solve only Steam run issue. To run games, they also should be fixed in same way. For example:

paxctl -Cm "/home/powerman/.local/share/Steam/SteamApps/common/World of Goo/WorldOfGoo"
paxctl -Cm /home/powerman/.local/share/Steam/SteamApps/common/Uplink/uplink.bin.x86_64
Ppowerman 2012-12-22 github

I've just noticed gameoverlayui (in same dir as steam binary) also should be paxmarked. Actually, it works ok without this, but I see errors in logs:

2012-12-22_01:20:37.35360 kern.alert: grsec: denied RWX mprotect of /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui.so by /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui[MainThrd:9050] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:8991] uid/euid:1000/1000 gid/egid:1000/1000
2012-12-22_01:20:37.35363 kern.info: MainThrd[9050]: segfault at 204 ip 00000000e69a1d4d sp 00000000f41c0320 error 4 in ld-2.15.so[e698d000+1e000]
2012-12-22_01:20:37.35363 kern.alert: grsec: Segmentation fault occurred at 0000000000000204 in /home/powerman/.local/share/Steam/ubuntu12_32/gameoverlayui[MainThrd:9050] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:8991] uid/euid:1000/1000 gid/egid:1000/1000
Ppowerman 2013-07-05 github

Workarounds mentioned above doesn't enough anymore (looks like latest steam update changed way to run games).

Since kernel 3.9.5 we can migrate from PT_PAX to XATTR_PAX, so paxmarking (using new paxctl-ng tool) doesn't modify binaries anymore, and thus doesn't conflict with steam (and some games) consistency check.

To run steam we still need to paxctl-ng -m steam binary, and same for games binaries. But in current steam version this result in ability to run steam client and manually run games (from command line), but games can't be run from steam interface!

Problem is, steam now run games in this way:

LD_LIBRARY_PATH=… LD_PRELOAD=:gameoverlayrenderer.so sh -c "/path/to/game"

this result in attempt to load gameoverlayrenderer.so in sh process, which fail with

$ LD_LIBRARY_PATH=… LD_PRELOAD=:gameoverlayrenderer.so sh
sh: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted
kern.alert: grsec: denied RWX mmap of /usr/lib64/opengl/nvidia/lib/libGL.so.319.23 by /bin/bash[sh:16425] uid/euid:1000/1000 gid/egid:1000/1000, parent /home/powerman/.local/share/Steam/ubuntu12_32/steam[CIPCServer::Thr:15657] uid/euid:1000/1000 gid/egid:1000/1000

To fix it we have to paxctl-ng -m /bin/bash which doesn't looks good. :(

Pprometheanfire 2013-07-21 github

paxctl-ng -m /bin/bash ~/.local/share/Steam/ubuntu12_32/steam ~/.local/share/Steam/ubuntu12_32/gameoverlayui does not allow steam to run for me. has there been a recent update that caused it to fail?

Pprometheanfire 2013-07-21 github

ah, the 'paxctl-ng -m /bin/bash' causes bash to fail to run :D

Iidl0r 2014-02-10 github

#3116 might also be interesting for you guys

DDiewi 2014-02-12 github

Hi, I'm also using a Gentoo 64-bit Hardened system.
Like noted before, the migration to XATTR flags solved the modification of binaries issue.
PAX-marking the steam binary and a games' executable (like hl2_linux for CS Source) was enough to get it running from the interface and from the link on my desktop, which uses the steam-url.

However, I'm using an Intel HD graphics card for that, maybe this issue is related to the nvidia binary driver.
I hope, these observations help in some way.

Pprometheanfire 2014-02-12 github

I'm on intel as well :P

Kklondi 2014-08-23 github

Whether this is steam's fault or some missunderstanding this is the worst possible way of preloading a library and basically a bug waiting to happen as you are preloading the library for sh which may depend on symbols being overwritten by the preloaded library

The most appropriate way would be something along these lines:
sh -c 'export "LD_LIBRARY_PATH=…" "LD_PRELOAD=$LD_PRELOAD:gameoverlayrenderer.so"; "/path/to/game"'
Being careful to escape single quotes inside the paths if any.

An even cleaner way would be this:
sh -c 'export "LD_LIBRARY_PATH=…" "LD_PRELOAD=$LD_PRELOAD:gameoverlayrenderer.so"; exec "/path/to/game"'

And of course the best way would involve just using fork and execve modifying the environment variable list being passed.

Ll29ah 2016-07-10 github

Still an issue, using this to make it work with PaX atm:
paxctl-ng -m ~/.config/Steam/ubuntu12_32/{steam,steamwebhelper,gameoverlayui}

Nntnn 2016-11-22 github

This would be fixed relatively easy by allowing users to add hooks (e,g, via an env var or in folders) at specific points in the wrapper scripts.
Sufficient would probably be before starting/restarting steam for the moment, just to be able to start steam in the first place.

Nothing extracted yet.