Messages in this thread | | | Subject | Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps | From | Alan Cox <> | Date | Sun, 24 Sep 2006 20:59:38 +0100 |
| |
Ar Sul, 2006-09-24 am 20:31 +0400, ysgrifennodd Stas Sergeev: > 1. mprotect() the existing mapping to PROT_EXEC and bypass the > checks (but you can easily restrict that by patching mprotect()).
Bug: To be fixed
> 2. Do the anonymous mmap with PROT_EXEC set, then simply read() > the code there, then execute. This you *can not* restrict!
Its a non-finite turing machine, you can also execute an interpreter.
> Now, the breakage of the properly-written programs forces people > to stop using "noexec" on /dev/shm-mounted tmpfs. As far as I
But you've already just argued that this isn't useful anyway ?
> understand, having the single writeable and executable mountpoint > is almost as bad as having all of them. The attacker will now simply > put his binary into /dev/shm.
SELinux
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |