Messages in this thread | | | From | Linus Torvalds <> | Date | Sat, 22 Oct 2011 21:41:08 +0300 | Subject | Re: [PATCH 1/2] LSM: Do not apply mmap_min_addr check to PROT_NONE mappings |
| |
On Sat, Oct 22, 2011 at 9:32 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > So I was looking for some *other* reason for the patch. > > Because, quite frankly, "security hardening" is absolutely *not* a > reason to do it - complex security is not "hardened", it's just > "harder and more likely to be buggy".
Btw, if the only concern is "you don't want to elevate the selinux denial to be some user-visible thing", then I'd suggest attacking *that* issue directly.
For example, maybe we could fail the PROT_NONE mmap (ie not actually create any mapping at all, and certainly not create anything that is then mprotectable), but return success and not elevate it to be reported.
But then it really is important to return success, because otherwise it would be a "silent probe" of the security model (ie a bad user could use the mmap(PROT_NONE) to see if min_mmap_addr is on or not without triggering any selinux warnings).
And unlike your patch, it wouldn't open up some new interface (mprotect) to worry about.
So I think it might be valid to say "always allow mmap(PROT_NONE) under mmap_min_limit, by simply turning it into a no-op".
Linus
| |