Messages in this thread | | | Date | Sat, 27 Aug 2016 00:32:27 +0300 | From | "Kirill A. Shutemov" <> | Subject | Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM_MAYEXEC taint |
| |
On Fri, Aug 26, 2016 at 12:30:04PM -0400, robert.foss@collabora.com wrote: > From: Will Drewry <wad@chromium.org> > > This patch proposes a sysctl knob that allows a privileged user to > disable ~VM_MAYEXEC tainting when mapping in a vma from a MNT_NOEXEC > mountpoint. It does not alter the normal behavior resulting from > attempting to directly mmap(PROT_EXEC) a vma (-EPERM) nor the behavior > of any other subsystems checking MNT_NOEXEC.
Wouldn't it be equal to remounting all filesystems without noexec from attacker POV? It's hardly a fence to make additional mprotect(PROT_EXEC) call, before starting executing code from such filesystems.
If administrator of the system wants this, he can just mount filesystem without noexec, no new kernel code required. And it's more fine-grained than this.
So, no, I don't think we should add knob like this. Unless I miss something.
NAK.
> It is motivated by a common /dev/shm, /tmp usecase. There are few > facilities for creating a shared memory segment that can be remapped in > the same process address space with different permissions.
What about using memfd_create(2) for such cases? You'll get a file descriptor from in-kernel tmpfs (shm_mnt) which is not exposed to userspace for remount as noexec.
-- Kirill A. Shutemov
| |