Messages in this thread | | | From | "Khimenko Victor" <> | Date | Tue, 28 Dec 1999 01:55:50 +0300 (MSK) | Subject | Re: Unexecutable stack |
| |
In <19991227191253.B7283@oxygene.terra.vein.hu> Gabor Lenart (lgb@oxygene.terra.vein.hu) wrote: GL> On Mon, Dec 27, 1999 at 08:37:59PM +0300, Khimenko Victor wrote: >> In <38673F5C.1010C79A@katren.ru> Mike Karmyshev (mike@katren.ru) wrote: >> > Hello. >> > I've recently played a bit with Solar Designer's patch and it looks that >> > it doesn't have any >> > significant overhead. Shoudn't it be in the kernel by default(at >> > least,SECURE_STACK)? >> >> Last time when this question was raised was more then year ago (if I recall >> correctly) and Linus said that his feeling about unexecutable stack is that >> it does not make exploits impossible but insted give you false sense of safety. >> So answer is "no". You can add such patch by hands if you wish...
GL> Hmmm. But kernel contains features marked 'experimental'.
`Experimental', not meaningless.
GL> Like experimental things, secure Linux patch can go into kernel with some GL> remark like experimantal. (in this case: "big warning, ...").
It's not experimental. Experimental == Linus thinks that feature is cool but it's not yet debugged enough to be used in production environment. And it's NOT a case.
GL> Pre-XFree 4.0 servers seem to segfault with this patch. Anyone who has got GL> similar sympthoms ?
GL> BTW, restricted proc fs should go into kernel tree (do not care in this case GL> if unexecutable stack goes in or not), because it's the minimum to have GL> an ability to hide my processes from others. It's VERY simple and trivial GL> patch, only alters file access permissions in /proc.
Once again: you should convinience Linus that it's good thing to do :-)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |