[lkml]   [2011]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH v3 2.6.39-rc1-tip 12/26] 12: uprobes: slot allocation for uprobes
    On Wed, 2011-04-20 at 10:51 -0400, Frank Ch. Eigler wrote:
    > eparis wrote:
    > > [...]
    > > Now how to fix the problems you were seeing. If you run a modern
    > > system with a GUI I'm willing to bet the pop-up window told you
    > > exactly how to fix your problem. [...]
    > >
    > > 1) chcon -t unconfined_execmem_t /path/to/your/binary
    > > 2) setsebool -P allow_execmem 1
    > > [...]
    > > I believe there was a question about how JIT's work with SELinux
    > > systems. They work mostly by method #1.
    > Actually, that's a solution to a different problem. Here, it's not
    > particular /path/to/your/binaries that want/need selinux provileges.
    > It's a kernel-driven debugging facility that needs it temporarily for
    > arbitrary processes.
    > It's not like JITs, with known binary names. It's not like GDB, which
    > simply overwrites existing instructions in the text segment. To make
    > uprobes work fast (single-step-out-of-line), one needs one or emore
    > temporary pages with unusual mapping permissions.

    I would expect that (2) would solve it, but couldn't distinguish the
    kernel-created mappings from userspace doing the same thing.
    Alternatively, you could temporarily switch your credentials around the
    mapping operation, e.g.:
    old_cred = override_creds(&init_cred);

    devtmpfs does something similar to avoid triggering permission checks on
    userspace when it is internally creating and deleting nodes.

    How is this ability to use this facility controlled?

    Stephen Smalley
    National Security Agency

     \ /
      Last update: 2011-04-20 17:27    [W:0.022 / U:164.984 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site