Re: [Announcement] "Exec Shield", new Linux security feature

From: Chuck Ebbert <76306.1226@compuserve.com>
To: Yoav Weiss <ml-lkml@unpatched.org>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [Announcement] "Exec Shield", new Linux security feature
Date: Sun, 4 May 2003 10:25:26 -0400	[thread overview]
Message-ID: <200305041027_MC3-1-3758-4298@compuserve.com> (raw)

> btw, I guess that now, at least when X_workaround==1, exploits will focus
> on getting iopl(2) called before they get the actual shellcode called.
> In some cases it may be easy to cause a call to iopl (param doesn't matter
> as long as its not zero).

  I looked at sys_iopl() and it seems to be checking if its param is
> 3, so EBX on the stack must be 0x00000003 to set iopl to 3.

  The declaration is misleading ("unused"???:)

asmlinkage int sys_iopl(unsigned long unused)
{
        struct pt_regs * regs = (struct pt_regs *) &unused;       <== yuck!
        unsigned int level = regs->ebx;
        ...
        if (level > 3)
                return -EINVAL;

  Shouldnt it be like this?

asmlinkage int sys_iopl (struct pt_regs regs)
{
        unsigned int level = regs.ebx;
        ...

fork, clone, vfork and execve all declare it that way...