From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751857AbWIXJSH (ORCPT ); Sun, 24 Sep 2006 05:18:07 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751864AbWIXJSH (ORCPT ); Sun, 24 Sep 2006 05:18:07 -0400 Received: from excu-mxob-2.symantec.com ([198.6.49.23]:33471 "EHLO excu-mxob-2.symantec.com") by vger.kernel.org with ESMTP id S1751857AbWIXJSF (ORCPT ); Sun, 24 Sep 2006 05:18:05 -0400 Date: Sun, 24 Sep 2006 10:17:38 +0100 (BST) From: Hugh Dickins X-X-Sender: hugh@blonde.wat.veritas.com To: Stas Sergeev cc: Alan Cox , Andrew Morton , Ulrich Drepper , Linux kernel Subject: Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps In-Reply-To: <45162BE5.2020100@aknet.ru> Message-ID: References: <45150CD7.4010708@aknet.ru> <451555CB.5010006@aknet.ru> <1159037913.24572.62.camel@localhost.localdomain> <45162BE5.2020100@aknet.ru> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-OriginalArrivalTime: 24 Sep 2006 09:17:29.0637 (UTC) FILETIME=[42544D50:01C6DFBA] Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 24 Sep 2006, Stas Sergeev wrote: > Alan Cox wrote: > > Agreed mprotect should also be fixed. > Since "noexec" was already rendered useless - yes. > Before, people could use it and hope the binaries > won't get executed (and if it was possible to execute > them by invoking ld.so directly, then ld.so could have > been fixed). Now the only possibility is to not use the > "noexec" at all. > So does that add to security or substract?.. I'm very puzzled. The intention of "noexec" is to prevent execution of files on that mount. You're saying it's useless because it's preventing execution of files on that mount? It seems to me that you simply have a mount where "noexec" presents more problems than it solves: so don't use it there. That doesn't mean it's useless: not every mmap involves PROT_EXEC, not every mount demands execution. Hugh