From: Florian Weimer <fweimer@redhat.com> To: "Mickaël Salaün" <mic@digikod.net> Cc: linux-kernel@vger.kernel.org, "Aleksa Sarai" <cyphar@cyphar.com>, "Alexei Starovoitov" <ast@kernel.org>, "Al Viro" <viro@zeniv.linux.org.uk>, "Andy Lutomirski" <luto@kernel.org>, "Christian Heimes" <christian@python.org>, "Daniel Borkmann" <daniel@iogearbox.net>, "Eric Chiang" <ericchiang@google.com>, "James Morris" <jmorris@namei.org>, "Jan Kara" <jack@suse.cz>, "Jann Horn" <jannh@google.com>, "Jonathan Corbet" <corbet@lwn.net>, "Kees Cook" <keescook@chromium.org>, "Matthew Garrett" <mjg59@google.com>, "Matthew Wilcox" <willy@infradead.org>, "Michael Kerrisk" <mtk.manpages@gmail.com>, "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>, "Mimi Zohar" <zohar@linux.ibm.com>, "Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>, "Scott Shell" <scottsh@microsoft.com>, "Sean Christopherson" <sean.j.christopherson@intel.com>, "Shuah Khan" <shuah@kernel.org>, "Song Liu" <songliubraving@fb.com>, "Steve Dower" <steve.dower@python.org>, "Steve Grubb" <sgrubb@redhat.com>, "Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>, "Vincent Strubel" <vincent.strubel@ssi.gouv.fr>, "Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>, kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v2 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Date: Fri, 06 Sep 2019 17:56:32 +0200 Message-ID: <87ef0te7v3.fsf@oldenburg2.str.redhat.com> (raw) In-Reply-To: <20190906152455.22757-2-mic@digikod.net> (=?utf-8?Q?=22Micka?= =?utf-8?Q?=C3=ABl_Sala=C3=BCn=22's?= message of "Fri, 6 Sep 2019 17:24:51 +0200") Let's assume I want to add support for this to the glibc dynamic loader, while still being able to run on older kernels. Is it safe to try the open call first, with O_MAYEXEC, and if that fails with EINVAL, try again without O_MAYEXEC? Or do I risk disabling this security feature if I do that? Do we need a different way for recognizing kernel support. (Note that we cannot probe paths in /proc for various reasons.) Thanks, Florian
next prev parent reply index Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-06 15:24 [PATCH v2 0/5] Add support for O_MAYEXEC Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Mickaël Salaün 2019-09-06 15:56 ` Florian Weimer [this message] 2019-09-06 16:06 ` Mickaël Salaün 2019-09-06 16:48 ` Jeff Layton 2019-09-06 17:13 ` Aleksa Sarai 2019-09-06 19:43 ` Jeff Layton 2019-09-06 20:06 ` Andy Lutomirski 2019-09-06 20:51 ` Jeff Layton 2019-09-06 21:27 ` Andy Lutomirski 2019-09-06 22:12 ` Aleksa Sarai 2019-09-09 9:33 ` Mickaël Salaün 2019-09-06 22:05 ` Aleksa Sarai 2019-09-06 22:18 ` Aleksa Sarai 2019-09-06 17:14 ` Mickaël Salaün 2019-09-06 18:38 ` Jeff Layton 2019-09-06 18:41 ` Andy Lutomirski 2019-09-09 9:18 ` Mickaël Salaün 2019-09-09 15:49 ` Andy Lutomirski 2019-09-06 18:44 ` Florian Weimer 2019-09-06 19:03 ` James Morris 2019-09-09 9:25 ` Mickaël Salaün 2019-09-09 10:12 ` James Morris 2019-09-09 10:54 ` Mickaël Salaün 2019-09-09 12:28 ` Aleksa Sarai 2019-09-09 12:33 ` Mickaël Salaün 2019-09-09 11:54 ` Aleksa Sarai 2019-09-09 12:28 ` Mickaël Salaün 2019-09-06 17:07 ` Aleksa Sarai 2019-09-06 17:20 ` Christian Brauner 2019-09-06 17:24 ` Mickaël Salaün 2019-09-06 17:40 ` Tycho Andersen 2019-09-06 18:27 ` Florian Weimer 2019-09-06 18:46 ` Tycho Andersen 2019-09-06 15:24 ` [PATCH v2 2/5] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 3/5] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 4/5] selftest/exec: Add tests for O_MAYEXEC enforcing Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 5/5] doc: Add documentation for the fs.open_mayexec_enforce sysctl Mickaël Salaün 2019-09-06 18:50 ` [PATCH v2 0/5] Add support for O_MAYEXEC Steve Grubb 2019-09-06 18:57 ` Florian Weimer 2019-09-06 19:07 ` Steve Grubb 2019-09-06 19:26 ` Andy Lutomirski 2019-09-06 22:44 ` Aleksa Sarai 2019-09-09 9:09 ` Mickaël Salaün 2019-09-09 0:16 ` James Morris
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=87ef0te7v3.fsf@oldenburg2.str.redhat.com \ --to=fweimer@redhat.com \ --cc=ast@kernel.org \ --cc=christian@python.org \ --cc=corbet@lwn.net \ --cc=cyphar@cyphar.com \ --cc=daniel@iogearbox.net \ --cc=ericchiang@google.com \ --cc=jack@suse.cz \ --cc=jannh@google.com \ --cc=jmorris@namei.org \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=luto@kernel.org \ --cc=mic@digikod.net \ --cc=mickael.salaun@ssi.gouv.fr \ --cc=mjg59@google.com \ --cc=mtk.manpages@gmail.com \ --cc=philippe.trebuchet@ssi.gouv.fr \ --cc=scottsh@microsoft.com \ --cc=sean.j.christopherson@intel.com \ --cc=sgrubb@redhat.com \ --cc=shuah@kernel.org \ --cc=songliubraving@fb.com \ --cc=steve.dower@python.org \ --cc=thibaut.sautereau@ssi.gouv.fr \ --cc=vincent.strubel@ssi.gouv.fr \ --cc=viro@zeniv.linux.org.uk \ --cc=willy@infradead.org \ --cc=yves-alexis.perez@ssi.gouv.fr \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-Fsdevel Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-fsdevel/0 linux-fsdevel/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-fsdevel linux-fsdevel/ https://lore.kernel.org/linux-fsdevel \ linux-fsdevel@vger.kernel.org public-inbox-index linux-fsdevel Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-fsdevel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git