lkml.org 
[lkml]   [2016]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [kernel-hardening] [RFC 0/4] make call_usermodehelper a bit more "safe"
Hi Greg,

On Wed, Dec 14, 2016 at 7:50 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
> So, anyone have any better ideas? Is this approach worth it? Or should
> we just go down the "whitelist" path?

I think your approach is generally better than the whitelist path. But
maybe there's yet a third approach that involves futzing with page
permissions at runtime. I think grsec does something similar with
read_mostly function pointer structs. Namely, they make them read-only
const, and then temporarily twiddle the page permissions if it needs
to be changed while disabling preemption. There could be a particular
class of data that needs to be "opened" and "closed" in order to
modify. Seems like these strings would be a good use of that.

Jason

\
 
 \ /
  Last update: 2016-12-14 22:28    [W:0.109 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site