Messages in this thread |  | | | From | Andy Lutomirski <> | | Date | Thu, 8 Mar 2012 12:02:50 -0800 | | Subject | Re: [RFC] c/r: prctl: Add ability to set new mm_struct::exe_file v3 |
| |
On Thu, Mar 8, 2012 at 11:40 AM, Cyrill Gorcunov <gorcunov@openvz.org> wrote: > On Thu, Mar 08, 2012 at 11:31:58AM -0800, Kees Cook wrote: > ... >> > + err = -EACCES; >> > + if (!S_ISREG(dentry->d_inode->i_mode) || >> > + exe_file->f_path.mnt->mnt_flags & MNT_NOEXEC) >> > + goto exit; >> >> I'm starting to notice that this pattern (testing ISREG and >> MNT_NOEXEC) is getting repeated a few times in the kernel, and at >> least the no-new-privs patch (not yet in -mm but hopefully soon given >> the seccomp_filter work) updates this pattern everywhere. Perhaps this >> should be extracted into a helper first, and then this patch can call >> that helper here? (And then nnp can just update the single helper.) >> > > I can do that if Andrew agree.
I'm a bit lost. nnp updates the MNT_NOSUID checks, not the MNT_NOEXEC checks. (And the effects of the two flags is different in selinux for historical reasons.) I'm sure I'm missing something.
--Andy
> > Cyrill -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |