lkml.org 
[lkml]   [2006]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    Date
    Ulrich Drepper  wrote:
    >noexec mounts the way _you_ want them are completely, utterly useless.
    >nonexec mounts as they are today plus an upcoming mprotect patch give
    >fine grained control.

    Are you familiar with the mmap(PROT_EXEC, MAP_ANONYMOUS) loophole?

    Even with the upcoming mprotect patch, it will still be straightforward
    to circumvent the noexec protections.

    >You have to use additional mechanism like SELinux
    >to fill in all the holes but that's OK.

    Is it even possible to use SELinux to fill in all the holes? Can you
    point me to the SELinux policy that fills in all the holes (including,
    for instance, addressing mmap(PROT_EXEC, MAP_ANONYMOUS))?
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-10-04 05:15    [W:5.441 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site