linux-kernel - Re: [PATCH v3 2.6.39-rc1-tip 12/26] 12: uprobes: slot allocation for uprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <y0m7hapc6wu.fsf@fche.csb>
Date:	Wed, 20 Apr 2011 10:51:45 -0400
From:	fche@...hat.com (Frank Ch. Eigler)
To:	Eric Paris <eparis@...isplace.org>
Cc:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	int-list-linux-mm@...ck.org, linux-mm@...ck.org,
	Peter Zijlstra <peterz@...radead.org>,
	James Morris <jmorris@...ei.org>, Ingo Molnar <mingo@...e.hu>,
	Steven Rostedt <rostedt@...dmis.org>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Jonathan Corbet <corbet@....net>,
	Christoph Hellwig <hch@...radead.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Oleg Nesterov <oleg@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	SystemTap <systemtap@...rces.redhat.com>,
	Jim Keniston <jkenisto@...ux.vnet.ibm.com>,
	Roland McGrath <roland@...k.frob.com>,
	Andi Kleen <andi@...stfloor.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Eric Paris <eparis@...hat.com>, sds@...ho.nsa.gov
Subject: Re: [PATCH v3 2.6.39-rc1-tip 12/26] 12: uprobes: slot allocation for uprobes


eparis wrote:

> [...]
> Now how to fix the problems you were seeing.  If you run a modern
> system with a GUI I'm willing to bet the pop-up window told you
> exactly how to fix your problem.  [...]
>
> 1) chcon -t unconfined_execmem_t /path/to/your/binary
> 2) setsebool -P allow_execmem 1
> [...]
> I believe there was a question about how JIT's work with SELinux
> systems.  They work mostly by method #1.

Actually, that's a solution to a different problem.  Here, it's not
particular /path/to/your/binaries that want/need selinux provileges.
It's a kernel-driven debugging facility that needs it temporarily for
arbitrary processes.

It's not like JITs, with known binary names.  It's not like GDB, which
simply overwrites existing instructions in the text segment.  To make
uprobes work fast (single-step-out-of-line), one needs one or emore
temporary pages with unusual mapping permissions.

- FChE
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/