Messages in this thread | | | From | Topi Miettinen <> | Subject | selinux: should execmem disable shmat(..., SHM_EXEC)? | Date | Wed, 26 Oct 2016 20:31:36 +0000 |
| |
Hi,
Maybe this is a stupid question and I didn't test this with SELinux, but it looks to me that SELinux execmem does not prevent process from getting writable and executable memory mappings by using shmat(..., SHM_EXEC). Shouldn't this be blocked by execmem, I suppose it is there to prevent this kind of memory access?
Here's a test program: #include <sys/ipc.h> #include <sys/shm.h>
int main(void) { int shmid; char *execmem; void (*fn)(void);
shmid = shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0777); execmem = shmat(shmid, 0, SHM_EXEC); shmctl(shmid, IPC_RMID, 0); *execmem = 0xc3; // retq fn = (void (*)(void))execmem; fn(); shmdt(execmem); }
-Topi
| |