linux-kernel - Re: [patch] remove MNT_NOEXEC check for PROT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 24 Sep 2006 10:17:38 +0100 (BST)
From:	Hugh Dickins <hugh@...itas.com>
To:	Stas Sergeev <stsp@...et.ru>
cc:	Alan Cox <alan@...rguk.ukuu.org.uk>, Andrew Morton <akpm@...l.org>,
	Ulrich Drepper <drepper@...hat.com>,
	Linux kernel <linux-kernel@...r.kernel.org>
Subject: Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps

On Sun, 24 Sep 2006, Stas Sergeev wrote:
> Alan Cox wrote:
> > Agreed mprotect should also be fixed.
> Since "noexec" was already rendered useless - yes.
> Before, people could use it and hope the binaries
> won't get executed (and if it was possible to execute
> them by invoking ld.so directly, then ld.so could have
> been fixed). Now the only possibility is to not use the
> "noexec" at all.
> So does that add to security or substract?..

I'm very puzzled.  The intention of "noexec" is to prevent execution
of files on that mount.  You're saying it's useless because it's
preventing execution of files on that mount?  It seems to me that
you simply have a mount where "noexec" presents more problems than
it solves: so don't use it there.  That doesn't mean it's useless:
not every mmap involves PROT_EXEC, not every mount demands execution.

Hugh
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/