linux-kernel - Re: [PATCH v3] devtmpfs: mount with noexec and nosuid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 21 Nov 2012 12:42:04 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Roland Eggner <edvx1@...temanalysen.net>
Cc:	Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	ellyjones@...omium.org, Kay Sievers <kay@...y.org>
Subject: Re: [PATCH v3] devtmpfs: mount with noexec and nosuid

> 	  This instructs the kernel to include the MS_NOEXEC and MS_NOSUID mount
> 	  flags when mounting devtmpfs.

So does a mount syscall

> 	  In-kernel separation of executable and non-executable code combined
> 	  with a proper executability policy is a basic technique to protect
> 	  against exploits by buggy or malicious code or hardware errors.  In
> 	  terms of overhead it is a low-cost-high-effect technique especially on
> 	  platforms with dedicated hardware support, e.g. x86_64 (look for "NX"
> 	  feature in BIOS settings).  Mounting devtmpfs with MS_NOEXEC flag is
> 	  an essential building-block for this security technique.

Which is done via a mount syscall

> 
> 	  Notice:  If enabled, software which depends on execution of
> 	  runtime-generated code can only be used with restricted feature set or
> 	  not at all, e.g. proprietary video drivers, JIT-compilers, most modern
> 	  web browsers.  The grsecurity-patchset provides exception mechanisms to
> 	  solve this problem for e.g. desktop systems.

We don't generally advertise random third party patches in Kconfig
> 
> 	  For server and embedded systems with HA-requirements consider Y.

That is totally misleading. HA has no connection to security and sever
and most embedded systems have nothing to gain from this feature as they
have both other writable storage and interpreters available. So if you
are attacking a server box you don't care about noexec, you feed the
script to perl.

NAK
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/