INTRO (7) NetBSD Miscellaneous Information Manual INTRO (7 ...
INTRO (7) NetBSD Miscellaneous Information Manual INTRO (7 ...
INTRO (7) NetBSD Miscellaneous Information Manual INTRO (7 ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
SYSCTL (7) <strong>NetBSD</strong> <strong>Miscellaneous</strong> <strong>Information</strong> <strong>Manual</strong> SYSCTL (7)<br />
security.pax<br />
Settings for PaX -- exploit mitigation features. For more information on any ofthe PaX features,<br />
please see paxctl(8) and security(8).<br />
security.pax.aslr.enable<br />
Enable PaX ASLR (Address Space Layout Randomization).<br />
The value of this knob must be non-zero for PaX ASLR to be enabled, even ifa program<br />
is set to explicit enable.<br />
security.pax.aslr.global<br />
Specifies the default global policy for programs without an explicit enable/disable flag.<br />
When non-zero, all programs will get PaX ASLR, except those exempted with<br />
paxctl(8). Otherwise, all programs will not get PaX ASLR, except those specifically<br />
marked as such with paxctl(8).<br />
security.pax.mprotect.enable<br />
Enable PaX MPROTECT restrictions.<br />
These are mprotect(2) restrictions to better enforce a WˆX policy. The value of this<br />
knob must be non-zero for PaX MPROTECT to be enabled, even ifaprogram is set to<br />
explicit enable.<br />
security.pax.mprotect.global<br />
Specifies the default global policy for programs without an explicit enable/disable flag.<br />
When non-zero, all programs will get the PaX MPROTECT restrictions, except those<br />
exempted with paxctl(8). Otherwise, all programs will not get the PaX MPROTECT<br />
restrictions, except those specifically marked as such with paxctl(8).<br />
security.pax.segvguard.enable<br />
Enable PaX Segvguard.<br />
PaX Segvguard can detect and prevent certain exploitation attempts, where an attacker<br />
may try for example to brute-force function return addresses of respawning daemons.<br />
Note: The <strong>NetBSD</strong> interface and implementation of the Segvguard is still experimental,<br />
and may change in future releases.<br />
security.pax.segvguard.global<br />
Specifies the default global policy for programs without an explicit enable/disable flag.<br />
When non-zero, all programs will get the PaX Segvguard, except those exempted with<br />
paxctl(8). Otherwise, no program will get the PaX Segvguard restrictions, except<br />
those specifically marked as such with paxctl(8).<br />
security.pax.segvguard.expiry_timeout<br />
If the max number was not reached within this timeout (in seconds), the entry will<br />
expire.<br />
security.pax.segvguard.suspend_timeout<br />
Number of seconds to suspend a user from running a faulting program when the limit<br />
was exceeded.<br />
security.pax.segvguard.max_crashes<br />
Max number of segfaults a program can receive before suspension.<br />
<strong>NetBSD</strong> 3.0 December 27, 2007 31
Change language