paxctl(1)

📦 version 0.9, in alpine 3.24, nixos 26.05, nixpkgs unstable, ubuntu jammy

💅 paxctl — user-space utility to control PaX flags ✨

okay bestie, welcome to paxctl</paxctl> from the PaX manual, section 1. this is the little utility that lets you flip PaX flags on a per-binary basis, and honestly? it's giving gatekeeper energy in the best way. let's get into it 🫶

✨ NAME ✨

paxctl — a user-space utility to control PaX flags 🎀

🌸 SYNTAX 🌸

paxctl <flags> <files>

💖 DESCRIPTION 💖

paxctl is the tool that lets you modify PaX flags on a per-binary basis. PaX itself is part of the common security-enhancing kernel patches and secure distributions out there — think GrSecurity and Hardened Gentoo, respectively, if you want names.

🚨 real talk though: your system needs to be running a properly patched and configured kernel for this program to have any effect. no patched kernel, no vibes. periodt.

now for the flags, bestie, and there are a lot of them. buckle up 💀

  • -P — enforce paging based non-executable pages (PAGEEXEC) 🔥
  • -p — do not enforce paging based non-executable pages (NOPAGEEXEC)
  • -E — emulate trampolines (EMUTRAMP) 🦋
  • -e — do not emulate trampolines (NOEMUTRAMP)
  • -M — enforce secure memory protections (MPROTECT) 🛡️
  • -m — do not enforce secure memory protections (NOMPROTECT)
  • -R — randomize memory regions (RANDMMAP) 🎲
  • -r — do not randomize memory regions (NORANDMMAP)
  • -X — randomize base address of normal (ET_EXEC) executables (RANDEXEC)
  • -x — do not randomize base address of normal (ET_EXEC) executables (NORANDEXEC)
  • -S — enforce segmentation based non-executable pages (SEGMEXEC)
  • -s — do not enforce segmentation based non-executable pages (NOSEGMEXEC)
  • -v — view flags 👀
  • -z — reset all flags (further flags still apply) 🧼
  • -c — create the PT_PAX_FLAGS program header if it does not exist by converting the PT_GNU_STACK program header if it exists ✨
  • -C — create the PT_PAX_FLAGS program header if it does not exist by adding a new program header, if it is possible 🛠️
  • -q — suppress error messages 🤫
  • -Q — report flags in short format 📋

🎀 CAVEATS 🎀

okay this is the part where we sit down and have a serious little chat, bestie. 💜

The old PaX flag location and control method have been obsoleted. If your kernel and binaries use it, you have to use chpax(1) instead. (It is recommended to use PT_PAX_FLAGS along with -c or -C however.)

Converting PT_GNU_STACK into PT_PAX_FLAGS means that the information in the former is destroyed 😭 — in particular you must make sure that the EMUTRAMP PaX option is properly set in the newly created PT_PAX_FLAGS. The secure way is to disable EMUTRAMP first and if PaX reports stack execution attempts from nested function trampolines then enable it. like, do it in that order, fr fr.

Note that the new PT_PAX_FLAGS is created in the same state that binutils/ld itself would produce (equivalent to -zex).
Note that if you use both PT_PAX_FLAGS and the extended attribute PaX flags on a binary then they must be exactly the same (except for RANDEXEC). no cap.
Note that RANDEXEC is no longer supported by PaX kernels since 2.6.13, the paxctl flags are simply ignored there. 💀
Note that paxctl does not make backup copies of the files it modifies. 🙈 like, please back up your own stuff, i am begging.
Note that paxctl is meant to work on the native architecture's binaries only, however it should work on foreign binaries as long as they have the same endianess as the native architecture (e.g., an i386 paxctl should work on amd64 or little-endian arm but not on big-endian mips binaries). 🌈

👑 AUTHOR 👑

Written by The PaX Team <pageexec@freemail.hu> 💌

This manpage was adapted from the chpax manpage written by Martin F. Krafft <madduck@debian.org> for the Debian GNU/Linux Distribution, but may be used by others. 🫶

🔥 SEE ALSO 🔥

aaaand that's the whole page, bestie 💖 this one's the paxctl Manual, dated 2012-02-19, and it lives in section paxctl(1) of the PaX docs. go forth and flag responsibly, you icon 👑✨

📦 where this page comes from