Messages in this thread | | | Date | Tue, 3 Oct 2006 17:00:37 -0400 | From | Jakub Jelinek <> | Subject | Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps |
| |
On Tue, Oct 03, 2006 at 11:07:37PM +0400, Stas Sergeev wrote: > Arjan van de Ven wrote: > >then don't put noexec on /dev/shm. > That's obviously possible, but I'd feel safer having > "noexec" on *every* user-writable partition. It used > to work in the past - that way an attacker had no place > to run his binary from.
Even assuming ld.so would be hacked up so that it parses /proc/mounts to see if you are trying to run an executable via ld.so from noexec mount (which isn't going to happen), if mmap with PROT_EXEC is allowed on noexec mounts, you can always put there a shared library instead of a binary and put some interesting stuff in its constructors and then just LD_PRELOAD=/dev/shm/libmyhack.so /bin/true Really, if noexec is supposed to make any sense at all, it needs to prevent PROT_EXEC mapping/mprotect, otherwise it is completely useless.
Jakub - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |