[lkml]   [2012]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RFC] c/r: prctl: Add ability to set new mm_struct::exe_file v3
    On Thu, Mar 8, 2012 at 12:02 PM, Andy Lutomirski <> wrote:
    > On Thu, Mar 8, 2012 at 11:40 AM, Cyrill Gorcunov <> wrote:
    >> On Thu, Mar 08, 2012 at 11:31:58AM -0800, Kees Cook wrote:
    >> ...
    >>> > +       err = -EACCES;
    >>> > +       if (!S_ISREG(dentry->d_inode->i_mode)   ||
    >>> > +           exe_file->f_path.mnt->mnt_flags & MNT_NOEXEC)
    >>> > +               goto exit;
    >>> I'm starting to notice that this pattern (testing ISREG and
    >>> MNT_NOEXEC) is getting repeated a few times in the kernel, and at
    >>> least the no-new-privs patch (not yet in -mm but hopefully soon given
    >>> the seccomp_filter work) updates this pattern everywhere. Perhaps this
    >>> should be extracted into a helper first, and then this patch can call
    >>> that helper here? (And then nnp can just update the single helper.)
    >> I can do that if Andrew agree.
    > I'm a bit lost.  nnp updates the MNT_NOSUID checks, not the MNT_NOEXEC
    > checks.  (And the effects of the two flags is different in selinux for
    > historical reasons.)  I'm sure I'm missing something.

    Oops, you're right. Regardless, we might want helpers anyway. Better
    to have single places to do these tests.


    Kees Cook
    ChromeOS Security
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2012-03-08 21:09    [W:0.023 / U:128.784 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site