From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Roland Eggner <edvx1@systemanalysen.net>
Cc: Kees Cook <keescook@chromium.org>,
linux-kernel@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
ellyjones@chromium.org, Kay Sievers <kay@vrfy.org>
Subject: Re: [PATCH v3] devtmpfs: mount with noexec and nosuid
Date: Wed, 21 Nov 2012 12:42:04 +0000 [thread overview]
Message-ID: <20121121124204.1fbd690c@pyramind.ukuu.org.uk> (raw)
In-Reply-To: <20121121064450.GB3620@mobil.systemanalysen.net>
> This instructs the kernel to include the MS_NOEXEC and MS_NOSUID mount
> flags when mounting devtmpfs.
So does a mount syscall
> In-kernel separation of executable and non-executable code combined
> with a proper executability policy is a basic technique to protect
> against exploits by buggy or malicious code or hardware errors. In
> terms of overhead it is a low-cost-high-effect technique especially on
> platforms with dedicated hardware support, e.g. x86_64 (look for "NX"
> feature in BIOS settings). Mounting devtmpfs with MS_NOEXEC flag is
> an essential building-block for this security technique.
Which is done via a mount syscall
>
> Notice: If enabled, software which depends on execution of
> runtime-generated code can only be used with restricted feature set or
> not at all, e.g. proprietary video drivers, JIT-compilers, most modern
> web browsers. The grsecurity-patchset provides exception mechanisms to
> solve this problem for e.g. desktop systems.
We don't generally advertise random third party patches in Kconfig
>
> For server and embedded systems with HA-requirements consider Y.
That is totally misleading. HA has no connection to security and sever
and most embedded systems have nothing to gain from this feature as they
have both other writable storage and interpreters available. So if you
are attacking a server box you don't care about noexec, you feed the
script to perl.
NAK
prev parent reply other threads:[~2012-11-21 12:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-20 21:50 [PATCH v3] devtmpfs: mount with noexec and nosuid Kees Cook
2012-11-21 0:05 ` Alan Cox
2012-11-21 0:17 ` Kees Cook
2012-11-21 0:29 ` Alan Cox
2012-11-21 6:44 ` Roland Eggner
2012-11-21 12:42 ` Alan Cox [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121121124204.1fbd690c@pyramind.ukuu.org.uk \
--to=alan@lxorguk.ukuu.org.uk \
--cc=edvx1@systemanalysen.net \
--cc=ellyjones@chromium.org \
--cc=gregkh@linuxfoundation.org \
--cc=kay@vrfy.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).