Willy,

I propose the attached patch (extracted from 2.4.33-ow1) for inclusion
into 2.4.34-pre.  (2.6 kernels could benefit from the same change, too.)

The patch adds a new compile-time option to control the support for
"ELF binaries with a.out format interpreters or a.out libraries".
Without this patch, such support is enabled on every system that enables
the support for ELF binaries - although 99% (100%?) of systems don't
need this hybrid functionality.  Moreover, this functionality poses a
security risk - as proven in practice:

	http://www.isec.pl/vulnerabilities/isec-0021-uselib.txt

This uselib() vulnerability did not affect default kernel builds with
the -ow patch specifically due to separation of the unneeded/risky code
into CONFIG_BINFMT_ELF_AOUT and having this option disabled by default.
(Yes, this change in -ow patches pre-dates the discovery of the uselib()
vulnerability.)

The patch also changes CONFIG_BINFMT_AOUT to be disabled by default on
archs that had it default to enabled.  The a.out support is similarly
risky and not audited/hardened with the same scrutiny that the ELF
support has received.

Thanks,

Alexander