Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110629183728.GA8163@albatros>
Date: Wed, 29 Jun 2011 22:37:28 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: kernel-hardening@...ts.openwall.com
Subject: Re: overview of PaX features

Solar,

On Wed, Jun 29, 2011 at 22:25 +0400, Solar Designer wrote:
> On Sun, Jun 26, 2011 at 10:33:21PM +0400, Vasiliy Kulikov wrote:
> > PaXTeam said there is almost nothing I can do with userspace NX.
> > Currently it is implemented as a "stack can be X unless GNU_STACK is
> > enabled" instead of secure by default policy.  It's impossible to fix it
> > not breaking the compatibility with old apps.  So, I'm skipping NOEXEC
> > options.
> 
> Please do break compatibility with a handful of old apps

That's not only about old apps, but also a default relaxed policy for
the toolchain:

http://www.gentoo.org/proj/en/hardened/gnu-stack.xml

> - but as a
> non-default option (which we're likely to make the default on Owl, just
> like we had non-executable stack by default with 2.4.x-ow kernels).
> 
> With OpenVZ, it needs to be configurable per-container.

For upstream linux the default policy is if no GNU_STACK present, the
stack flags is defined by a constant.  I think it makes sense for
the upsteam to change it to per pid namespace, with the same default.

A good idea!

Thanks,

-- 
Vasiliy

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.