Messages in this thread | | | Date | Tue, 2 Oct 2012 23:41:02 +0200 | Subject | Re: [PATCH] hardening: add PROT_FINAL prot flag to mmap/mprotect | From | Ard Biesheuvel <> |
| |
2012/10/2 Kees Cook <keescook@chromium.org>: >> If desired, additional restrictions can be imposed by using the >> security framework, e.g,, disallow non-final r-x mappings. > > Interesting; what kind of interface did you have in mind? >
The 'interface' we use is a LSM .ko which registers handlers for mmap() and mprotect() that fail the respective invocations if the passed arguments do not adhere to the policy.
>>> It seems like there needs to be a sensible way to detect that this flag is >>> available, though. >> >> I am open for suggestions to address this. Our particular >> implementation of the loader (on an embedded system) tries to set it >> on the first mmap invocation, and stops trying if it fails. Not the >> most elegant approach, I know ... > > Actually, that seems easiest. > > Has there been any more progress on this patch over-all? >
No progress.
-- Ard.
| |