[lkml]   [2005]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectProcess system call access list.

    [please CC me.]

    I was looking at phrack and many of the remote exploits rely on
    injecting some arbitrary code. Generally is is something like
    'exec("/bin/sh")' or something like that.

    I was wondering if a section could be added to the link phase of a
    user application that would keep a list/bit mask of all kernel calls
    that the compiler had encountered in some section.

    When the kernel loaded a process, it would keep a copy of the bit mask
    and perform a comparison to see if the process was intended to make
    the system call (perhaps only a sub-set of the entire system calls are

    Of course, I imagine there is some reason that a process would like to
    dynamically create it's own code [although it wouldn't be the
    majority?], so the bit mask could be set to all ones via some linker
    magic when building the user application.

    Generally it would help protect against remote code injection and some
    possible privilege elevation exploits by restricting system calls. On
    the down side, it is probably not fool proof and might give people a
    false sense of security. So perhaps it is not a good feature for the
    kernel to have.

    Sorry if this has been discussed before. Unlike disk encryption, I
    couldn't find a reference to this topic, but maybe my search was using
    the wrong nomenclature. The susinct question would be is this worth

    Bill Pringlemeir.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:09    [W:0.018 / U:43.928 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site