Messages in this thread |  | | | Date | Wed, 12 Jan 2005 23:28:51 -0800 | | From | Matt Mackall <> | | Subject | Re: thoughts on kernel security issues |
| |
On Wed, Jan 12, 2005 at 08:48:57PM -0800, Linus Torvalds wrote: > > > On Wed, 12 Jan 2005, Dave Jones wrote: > > > > For us thankfully, exec-shield has trapped quite a few remotely > > exploitable holes, preventing the above. > > One thing worth considering, but may be abit _too_ draconian, is a > capability that says "can execute ELF binaries that you can write to". > > Without that capability set, you can only execute binaries that you cannot > write to, and that you cannot _get_ write permission to (ie you can't be > the owner of them either - possibly only binaries where the owner is > root).
We can do that now with a combination of read-only and no-exec mounts.
-- Mathematics is the supreme nostalgia of our time. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |