Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps

Ulrich Drepper  wrote:
>noexec mounts the way _you_ want them are completely, utterly useless.
>nonexec mounts as they are today plus an upcoming mprotect patch give
>fine grained control.

Are you familiar with the mmap(PROT_EXEC, MAP_ANONYMOUS) loophole?

Even with the upcoming mprotect patch, it will still be straightforward
to circumvent the noexec protections.

>You have to use additional mechanism like SELinux
>to fill in all the holes but that's OK.

Is it even possible to use SELinux to fill in all the holes?  Can you
point me to the SELinux policy that fills in all the holes (including,
for instance, addressing mmap(PROT_EXEC, MAP_ANONYMOUS))?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Follow-Ups:
- Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
  - From: "Ulrich Drepper" <[email protected]>

References:
- Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
  - From: Ulrich Drepper <[email protected]>
- Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
  - From: Stas Sergeev <[email protected]>
- Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
  - From: Ulrich Drepper <[email protected]>

Prev by Date: Re: [RFC PATCH] add pci_{request,free}_irq take #2
Next by Date: Re: [PATCH 12/12] i386 boot: Add an ELF header to bzImage
Previous by thread: Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
Next by thread: Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
Index(es):
- Date
- Thread

[Index of Archives] [Kernel Newbies] [Netfilter] [Bugtraq] [Photo] [Stuff] [Gimp] [Yosemite News] [MIPS Linux] [ARM Linux] [Linux Security] [Linux RAID] [Video 4 Linux] [Linux for the blind] [Linux Resources]