Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps

Hello.

Arjan van de Ven wrote:
no what bothers me that on the one hand you want no execute from the
partition, and AT THE SAME TIME want stuff to execute from there (being
libraries or binaries, same thing to me).
The original problem came from "noexec" on /dev/shm
mount. There is no library and no binary there, but
the programs do shm_open(), ftruncate() and
mmap(MAP_SHARED, PROT_EXEC) to get some shared memory
with an exec perm. That fails.

That duality feels strange to me,
IMHO there should be some policy that can be achieved.
If the policy is: "noexec should fail execve()", then
this can be achieved, and that's what it was in the past.
What is the policy now? The things like a possibility
to mprotect() that memory to PROT_EXEC, or in case of a
MAP_PRIVATE, to simply use MAP_ANONYMOUS then read(),
suggests that there is no strict policy at all any more.

I could understand if you wanted noexec to be MORE strict; I fail to
understand why you want it LESS strict!
My point is that it is neither more not less strict with
such a change. If the workaround is trivial anyway
(either mprotect or use MAP_ANONYMOUS and read()), then
there is no point in such a strictness. On the other
hand, the programs break.
What was pointed out by Hugh is that the current behaveour
is needed to solve one particular problem, which is when
the user invokes ld.so directly and you want it to fail on
a noexec partition. I accept that argument, but I have to
add that the mmap change doesn't solve the similar problem
when the user uses ld.so directly to execute the binaries
he doesn't have an exec permissions for.
So I think another solution is needed: the one, preferrably,
not breaking an existing apps; solving both of the above
problems, not just one of them; allowing an admin to control
that behaveour in a convenient way.
My idea is to execute the loader with the fsuid=0. Then you
can do simply "chmod 'go-x' ld.so", and the problem solved.
I'd like any opinions on that idea, although nothing positive
is expected at that point. :)

What breaks?
You missed the beginning of the discussion, but briefly:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=386945
... breaks UML and dosemu.
Also I speculate that it makes Wine slower causing it to
fallback to read() if the windows partition is mounted with
"noexec" (which I think is/was common). In that case people
will never figure out why Wine suddenly became slower and
more memory-consuming than before.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: /lib/ld-2.2.4.so
    ... >I tried this and it seemed to not work on my Linux system. ... >user doesn't have the permission to execute, it is enough to have read ... >bin bzImage bzImage3 bzImage5 dev home lib mnt proc sbin ... >noexec, lets take this partition: ...
    (Vuln-Dev)
  • Re: Rule No fire
    ... > .Net document type of your schema that the rules will execute on. ... > are able to select your message as a parameter for the policy you are ... >>the orchestration is executed, the polict is loaded but no rule is fired ...
    (microsoft.public.biztalk.server)
  • Re: Preventing users installing programms...?
    ... Anyhow see the link below for the policy I was mentioning. ... To restrict users from running specific Windows programs on a standalone Windows ... >>can change permissions back to allow execute. ...
    (microsoft.public.win2000.security)
  • Re: [patch] remove MNT_NOEXEC check for PROT_EXEC mmaps
    ... partition, and AT THE SAME TIME want stuff to execute from there (being ... libraries or binaries, same thing to me). ... ask the Linux kernel to allow you to execute it, if it lives on a noexec ... Whatever it is, you are executing it, and the goal of noexec ...
    (Linux-Kernel)
  • Re: Subroutines and &
    ... # else execute this sub ... You are making sure that $MODE points to a sub, ... no strict 'refs'; ... only be used with the code-determined qw(Foo Bar Baz). ...
    (comp.lang.perl.misc)