OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: mmap(), security and /dev/zero

From: Daniel Carosone (dangeek.com.au)
Date: Wed Jun 23 2004 - 23:15:59 CDT

On Thu, Jun 24, 2004 at 02:11:20PM +1000, matthew green wrote:
> that's what i thought. i didn't follow thor's point anyway, if
> the file system is writable what is stopping me from adding the
> 'x' bit ?

you can set it, but it should be ignored if the fs is mounted noexec;
just like you can mknod on a nodev-mounted fs, but it won't make the
device accessible.

at the moment, it's only ignored for execve, not PROT_EXEC mappings,
which is the point/problem.

> to jonathan: a x-bit-required-for-PROT_EXEC change needs a lot
> of 'settle time' in -current. not for 2.0.

alas, too true.

--
Dan.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (NetBSD)

iD8DBQFA2lV/EAVxvV4N66cRAp9bAKDwpr5lhsA1skMeWk6lamC3CFyTngCg27Lf
+4VDtwti15OWMmJLM0+kLLM=
=EHJe
-----END PGP SIGNATURE-----