lkml.org 
[lkml]   [1998]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]
    Date
    Followup to:  <35CA1803.95659883@clampton.com>
    By author: Joseph Malicki <jmalicki@clampton.com>
    In newsgroup: linux.dev.kernel
    >
    > Now, this leads to a way to have a truly secure system: an EXPAND-UP
    > STACK. With an expand up stack, where the ESP increments rather than
    > decrements on a push, you can not overwrite the return address with
    > the address of your own function. This could probably be implementable
    > as an ELF flag, or maybe as a separate "architecture" with its own set
    > of compiled libraries (as the current system would not work, since you
    > would be calling a library that uses an expand-down stack). The
    > Intel architecture, at least, allows you to specify an expand-up
    > stack via the descriptor table segment type flag by setting it up
    > like a normal data segment.
    >

    Oh, no. That doesn't change the direction the stack pointer moves; it
    just changes the way the descriptor fields are interpreted.

    On Intel you really want to use PUSH, POP, CALL and RET, and they
    always expect a "hanging" stack.

    Most RISC machines to stack manipulation in software, though (using
    ordinary adds and subtracts; the stack pointer being a standard GPR),
    for which it would be pretty easy to do.

    -hpa
    --
    PGP: 2047/2A960705 BA 03 D3 2C 14 A8 A8 BD 1E DF FE 69 EE 35 BD 74
    See http://www.zytor.com/~hpa/ for web page and full PGP public key
    I am Bahá'í -- ask me about it or see http://www.bahai.org/
    "To love another person is to see the face of God." -- Les Misérables

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

    \
     
     \ /
      Last update: 2005-03-22 13:43    [W:4.909 / U:0.516 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site