# Grsecurity/Additional Utilities

This page will introduce you to some additional utilities. They are not required to use a grsecurity-enabled system, but are very useful and thus recommended.

## Controlling PaX Flags (paxctl)

Paxctl is a user-space utility for controlling PaX flags of executables (see Appendix/PaX Flags for a list of these flags).

### Installation

Download the latest version from the PaX website at http://pax.grsecurity.net/. In our case we downloaded paxctl-0.7.tar.bz2. Paxctl packages are not signed. Change into the directory you downloaded the package to and run the below commands.
The installation process does the following:
* Installs the paxctl program to /sbin.
* Installs paxctl's man pages to /usr/share/man/man1.
If you need to change either of these locations, modify the Makefile.

### Usage

To display all available command-line switches, run paxctl --help. Read the man page for more detailed information.

### Examples

Lets query what, if any, PaX flags have been enabled for /usr/bin/vi:
As you can see, paxctl could not display the flags because vi does not have the appropriate program header. We need to convert the header and query the flags again.
* Note that paxctl does not make backup copies of the files it modifies. It is recommended that you make backups of the binaries you want to modify.
With the appropriate program header in place, we can query and modify the PaX flags of vi.

## Displaying Program Capabilities (pspax)

The pspax program displays the run-time capabilities of all programs you have permission for. It is part of the pax-utils package. Pax-utils can be found at http://dev.gentoo.org/~vapier/dist/. It contains many useful tools for PaX but is not as critical as paxctl. The pax-utils package is maintained by the Hardened Gentoo Project.
Programs that the pax-utils package provides:
* pspax - Displays the run-time capabilities of all programs you have permission for.
* scanelf - Prints out information specific to the ELF structure of a binary.
* dumpelf - Converts a ELF file into human readable C code that defines a structure with the same image as the original ELF file.
For more information, see the Gentoo Linux guide to pax-utils.

### Installation

Gentoo Linux and Debian GNU/Linux users (and possibly others) can install the pax-utils package the same way they install any other application in their system. Below are instructions on how to compile and install it from the source.
Download the latest version from http://dev.gentoo.org/~vapier/dist/. In our case we downloaded pax-utils-0.4.tar.xz, the latest stable release at the time of writing. Change into the directory you downloaded the package to and run the below commands.
The installation process does the following:
* Installs the pspax, scanelf, dumpelf and scanmacho programs to /usr/bin.
* Installs README, BUGS, and TODO files to /usr/share/doc/pax-utils/.
* Installs man pages of pspax, scanelf and dumpelf to /usr/share/man/man1.
If you need to change any of these locations, modify the Makefile.

### Usage

To display all available command-line switches, run pspax --help. Read the man page for more detailed information.
Pspax shows the PaX flags of a single program as a string of characters (e.g. "peMRS"). Lowercase character means the flag is disabled, uppercase means it is enabled. Below is a table that shows these characters and their corresponding PaX flags used by grsecurity. The "Details" column contains a link to a detailed explanation of each flag.
| pspax flag | grsecurity's PaX flag | Details |
| E | PAX_EMUTRAMP | emutramp.txt |
| M | PAX_MPROTECT | mprotect.txt |
| P | PAX_PAGEEXEC | pageexec.txt |
| R | PAX_RANDMMAP | randmmap.txt |
| S | PAX_SEGMEXEC | segmexec.txt |

### Examples

The command pspax -p <process_id> displays information about a specific process, identified by its PID. It is unlikely that you happen to know or remember the PID of a process, so it is easier to refer to them by name. The below example uses the pidof command to find the PID of a process which it then passes on to pspax:

## Managing the Executable Stack of Binaries (execstack)

Execstack is a tool to set, clear or query executable stack flag of ELF binaries and shared libraries. It is part of the prelink program, but your Linux distribution may provide it as a separate package.

### Installation

You are very likely to find the prelink and/or execstack packages using your distribution's package management system. At least Gentoo, Debian, Red Hat and distributions based on them provide a prelink and/or execstack packages.

### Usage

To display all available command-line switches, run execstack --help. Read the man page for more detailed information. Online version of the man page can be found at http://linux.die.net/man/8/execstack.

### Examples

To check if a library has executable stack enabled, run:
The dash means libcrypto does not require an executable stack. If it did, the line would start with a capital "X" instead of a dash.
To query the status of all libraries in your system, run: