Messages in this thread | | | From | David Laight <> | Subject | RE: [PATCH v2 00/39] Shadowstacks for userspace | Date | Tue, 4 Oct 2022 09:57:48 +0000 |
| |
From: Kees Cook <keescook@chromium.org> ... > > > > If you don't want /proc/$pid/mem to be able to do stuff like that, > > then IMO the way to go is to change when /proc/$pid/mem uses > > FOLL_FORCE, or to limit overall write access to /proc/$pid/mem. > > Yeah, all reasonable. I just wish we could ditch FOLL_FORCE; it continues > to weird me out how powerful that fd's side-effects are.
Could you remove FOLL_FORCE from /proc/$pid/mem and add a /proc/$pid/mem_force that enable FOLL_FORCE but requires root (or similar) access.
Although I suspect gdb may like to have write access to code?
David
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
| |