[lkml]   [2012]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] c/r: prctl: Add ability to set new mm_struct::exe_file v3
On Thu, Mar 8, 2012 at 12:02 PM, Andy Lutomirski <> wrote:
> On Thu, Mar 8, 2012 at 11:40 AM, Cyrill Gorcunov <> wrote:
>> On Thu, Mar 08, 2012 at 11:31:58AM -0800, Kees Cook wrote:
>> ...
>>> > +       err = -EACCES;
>>> > +       if (!S_ISREG(dentry->d_inode->i_mode)   ||
>>> > +           exe_file->f_path.mnt->mnt_flags & MNT_NOEXEC)
>>> > +               goto exit;
>>> I'm starting to notice that this pattern (testing ISREG and
>>> MNT_NOEXEC) is getting repeated a few times in the kernel, and at
>>> least the no-new-privs patch (not yet in -mm but hopefully soon given
>>> the seccomp_filter work) updates this pattern everywhere. Perhaps this
>>> should be extracted into a helper first, and then this patch can call
>>> that helper here? (And then nnp can just update the single helper.)
>> I can do that if Andrew agree.
> I'm a bit lost.  nnp updates the MNT_NOSUID checks, not the MNT_NOEXEC
> checks.  (And the effects of the two flags is different in selinux for
> historical reasons.)  I'm sure I'm missing something.

Oops, you're right. Regardless, we might want helpers anyway. Better
to have single places to do these tests.


Kees Cook
ChromeOS Security
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2012-03-08 21:09    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean