Date: Sun, 24 Sep 2006 10:17:38 +0100 (BST)
From: Hugh Dickins <hugh@veritas.com>
To: Stas Sergeev <stsp@aknet.ru>
cc: Alan Cox <alan@lxorguk.ukuu.org.uk>, Andrew Morton <akpm@osdl.org>,
       Ulrich Drepper <drepper@redhat.com>,
       Linux kernel <linux-kernel@vger.kernel.org>
Subject: Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
In-Reply-To: <45162BE5.2020100@aknet.ru>
Message-ID: <Pine.LNX.4.64.0609241009020.17400@blonde.wat.veritas.com>
References: <45150CD7.4010708@aknet.ru>  <Pine.LNX.4.64.0609231555390.27012@blonde.wat.veritas.com>
  <451555CB.5010006@aknet.ru>  <Pine.LNX.4.64.0609231647420.29557@blonde.wat.veritas.com>
 <1159037913.24572.62.camel@localhost.localdomain> <45162BE5.2020100@aknet.ru>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1098
Lines: 24

On Sun, 24 Sep 2006, Stas Sergeev wrote:
> Alan Cox wrote:
> > Agreed mprotect should also be fixed.
> Since "noexec" was already rendered useless - yes.
> Before, people could use it and hope the binaries
> won't get executed (and if it was possible to execute
> them by invoking ld.so directly, then ld.so could have
> been fixed). Now the only possibility is to not use the
> "noexec" at all.
> So does that add to security or substract?..

I'm very puzzled.  The intention of "noexec" is to prevent execution
of files on that mount.  You're saying it's useless because it's
preventing execution of files on that mount?  It seems to me that
you simply have a mount where "noexec" presents more problems than
it solves: so don't use it there.  That doesn't mean it's useless:
not every mmap involves PROT_EXEC, not every mount demands execution.

Hugh
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/