Messages in this thread | | | Date | Sun, 24 Sep 2006 10:17:38 +0100 (BST) | From | Hugh Dickins <> | Subject | Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps |
| |
On Sun, 24 Sep 2006, Stas Sergeev wrote: > Alan Cox wrote: > > Agreed mprotect should also be fixed. > Since "noexec" was already rendered useless - yes. > Before, people could use it and hope the binaries > won't get executed (and if it was possible to execute > them by invoking ld.so directly, then ld.so could have > been fixed). Now the only possibility is to not use the > "noexec" at all. > So does that add to security or substract?..
I'm very puzzled. The intention of "noexec" is to prevent execution of files on that mount. You're saying it's useless because it's preventing execution of files on that mount? It seems to me that you simply have a mount where "noexec" presents more problems than it solves: so don't use it there. That doesn't mean it's useless: not every mmap involves PROT_EXEC, not every mount demands execution.
Hugh - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |