lkml.org 
[lkml]   [2011]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/2] LSM: Do not apply mmap_min_addr check to PROT_NONE
From
On Fri, Oct 28, 2011 at 6:37 PM, Roland McGrath <roland@hack.frob.com> wrote:
>> Since mmap_min_addr is used to prevent a *malicious* process from maping the
>> zero page and then taking advantage of a user-pointer dereference in the
>> *kernel code*, I do not see what you gain by guaranteeing that the
>> application *that you control* would never exploit such a vulnerability?
>
> The application does sandboxing of untrusted code.
>

Makes sense, thanks.

Out of curiosity, what kind of sandbox exactly? I'm guessing you need
to prevent many other operations, e.g., by intercepting some system
calls. In that case, you could also ensure that such an mmap never
occurs...

--
- Greg


\
 
 \ /
  Last update: 2011-10-28 20:03    [W:0.130 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site