lkml.org 
[lkml]   [2015]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v2 2/3] x86/ldt: Make modify_ldt optional
On Tue, Jul 21, 2015 at 1:20 PM, Sasha Levin <sasha.levin@oracle.com> wrote:
> On 07/21/2015 03:59 PM, Andy Lutomirski wrote:
>> The modify_ldt syscall exposes a large attack surface and is
>> unnecessary for modern userspace. Make it optional.
>
> Since this a "default y" option I think we need to make the
> implications of this a bit clearer.

Do you mean improving the help text? To be clear, there's no change
on a non-EXPERT of default EXPERT kernel here.

>
> Do we know what userspace would break?

Some Wine and some DOSEMU most likely. Also many of the exploits I've
written over the past year or two :)

>
> Maybe add a WARN_ONCE() in a stub syscall?
>

I think if we do that then we should do it for all the syscall disabling things.

--Andy


\
 
 \ /
  Last update: 2015-07-21 22:41    [W:1.125 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site