[lkml]   [2005]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectProcess system call access list.

[please CC me.]

I was looking at phrack and many of the remote exploits rely on
injecting some arbitrary code. Generally is is something like
'exec("/bin/sh")' or something like that.

I was wondering if a section could be added to the link phase of a
user application that would keep a list/bit mask of all kernel calls
that the compiler had encountered in some section.

When the kernel loaded a process, it would keep a copy of the bit mask
and perform a comparison to see if the process was intended to make
the system call (perhaps only a sub-set of the entire system calls are

Of course, I imagine there is some reason that a process would like to
dynamically create it's own code [although it wouldn't be the
majority?], so the bit mask could be set to all ones via some linker
magic when building the user application.

Generally it would help protect against remote code injection and some
possible privilege elevation exploits by restricting system calls. On
the down side, it is probably not fool proof and might give people a
false sense of security. So perhaps it is not a good feature for the
kernel to have.

Sorry if this has been discussed before. Unlike disk encryption, I
couldn't find a reference to this topic, but maybe my search was using
the wrong nomenclature. The susinct question would be is this worth

Bill Pringlemeir.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:09    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean