Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755900Ab2EPPOZ (ORCPT ); Wed, 16 May 2012 11:14:25 -0400 Received: from mail-wi0-f172.google.com ([209.85.212.172]:36173 "EHLO mail-wi0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755734Ab2EPPOV convert rfc822-to-8bit (ORCPT ); Wed, 16 May 2012 11:14:21 -0400 MIME-Version: 1.0 In-Reply-To: References: <1336963631-3541-1-git-send-email-zohar@us.ibm.com> <1337112446.20904.50.camel@falcor> From: Linus Torvalds Date: Wed, 16 May 2012 08:13:59 -0700 X-Google-Sender-Auth: BN3XFSaDOPhaGzdp7g3suFcfUaA Message-ID: Subject: Re: [PATCH] vfs: fix IMA lockdep circular locking dependency To: Eric Paris Cc: Mimi Zohar , Mimi Zohar , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Al Viro , Stephen Smalley Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1258 Lines: 33 On Wed, May 16, 2012 at 7:13 AM, Eric Paris wrote: > > So we would have no checks for anonymous mappings? ?We actually do > have some controls around them today > > http://www.akkadia.org/drepper/selinux-mem.html > > It's mostly around W+X memory. ?(or was W now X memory) Ahh, ok. So I guess that won't work. That said, I think do_brk() can already today be used to avoid those checks, since it does a mmap with VM_DATA_DEFAULT_FLAGS, which includes exec if the current personality includes READ_IMPLIES_EXEC - which is trivial yo do. I wonder if the rwx checks could be split up too - the access protection from the *file* is really a separate issue from the access protection of the *mapping*, if you see what I mean.. Then we could do it at do_brk() time too. Linus > > Admittedly with the growing prevalence of JiT stuff we are using those > protections less and less and less.... > > Not certain how happy some will be to see them completely disappear.... -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/