Date: Fri, 2 May 2003 18:46:20 -0400
From: Chuck Ebbert <76306.1226@compuserve.com>
Subject: Re: [Announcement] "Exec Shield", new Linux security feature
To: John Bradford <john@grabjohn.com>
Cc: linux-kernel <linux-kernel@vger.kernel.org>
Message-ID: <200305021847_MC3-1-3725-A1B@compuserve.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	 charset=us-ascii
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1114
Lines: 24

John Bradford wrote:

> Slightly off-topic, but does anybody know whether IA64 or x86-64 allow
> you to make the stack non-executable in the same way you can on SPARC?

 IA64 supports a mind-boggling variety of page-level protection modes,
including execute-only pages that usermode can jump to and get
'promoted' to lower (more privileged) levels.  _And_ it supports
protection keys that can be attached to pages so your process needs
to have the key loaded into a register to touch those pages.  The keys
can themselves be marked read/write/execute disable on loading, so
the supervisor can give you a key that keeps you from executing pages
even if their page-level protections would otherwise allow it.

 AMD64 supports a simple NX (no execute) bit that keeps both supervisor
and user code from executing, and that's probably all anyone really needs.

------
 Chuck
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/