Re: [patch] honour MNT_NOEXEC for access()

Hello.

Arjan van de Ven wrote:

but ld.so seems to be
the special case - it is a kernel helper after all,

in what way is ld.so special in ANY way?

It is a kernel helper. Kernel does all the security
checks before invoking it. However, when invoked
directly, it have to do these checks itself. So it is
special in a way that it have to do the security checks
which otherwise only the kernel should do.
Otherwise, please tell me, how can you solve the problem
of ld.so started directly, can execute the files you do
not have an exec permission for? The MNT_NOEXEC hack of
mmap doesn't solve that.

Jeremy proposed playing with flags - interesting.
What if the MAP_EXECUTABLE flag, which is currently unused,
will be used for the program to explicitly specify that it
needs an exec permission on the file, and fail otherwise?
Then ld.so can just use that to solve all those permission
problems.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: "Horst H. von Brand" <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Arjan van de Ven <[email protected]>

• References:
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Arjan van de Ven <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Arjan van de Ven <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Arjan van de Ven <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Jakub Jelinek <[email protected]>
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    • From: Stas Sergeev <[email protected]>
  • [patch] honour MNT_NOEXEC for access()
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Alan Cox <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Ulrich Drepper <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Ulrich Drepper <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Stas Sergeev <[email protected]>
  • Re: [patch] honour MNT_NOEXEC for access()
    • From: Arjan van de Ven <[email protected]>

• Prev by Date: Re: [patch] honour MNT_NOEXEC for access()
• Next by Date: Re: + clocksource-initialize-list-value.patch added to -mm tree
• Previous by thread: Re: [patch] honour MNT_NOEXEC for access()
• Next by thread: Re: [patch] honour MNT_NOEXEC for access()
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]