Messages in this thread | | | From | Florian Weimer <> | Subject | Re: [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() | Date | Tue, 16 Apr 2019 13:49:39 +0200 |
| |
* Steve Grubb:
> This flag that is being proposed means that you would have to patch all > interpreters to use it. If you are sure that upstreams will accept that, why > not just change the policy to interpreters shouldn't execute anything unless > the execute bit is set? That is simpler and doesn't need a kernel change. And > setting the execute bit is an auditable event.
I think we need something like O_MAYEXEC so that security policies can be enforced and noexec mounts can be detected. I don't think it's a good idea to do this in userspace, especially the latter.
Thanks, Florian
| |