|
Message-ID: <20110629183728.GA8163@albatros> Date: Wed, 29 Jun 2011 22:37:28 +0400 From: Vasiliy Kulikov <segoon@...nwall.com> To: kernel-hardening@...ts.openwall.com Subject: Re: overview of PaX features Solar, On Wed, Jun 29, 2011 at 22:25 +0400, Solar Designer wrote: > On Sun, Jun 26, 2011 at 10:33:21PM +0400, Vasiliy Kulikov wrote: > > PaXTeam said there is almost nothing I can do with userspace NX. > > Currently it is implemented as a "stack can be X unless GNU_STACK is > > enabled" instead of secure by default policy. It's impossible to fix it > > not breaking the compatibility with old apps. So, I'm skipping NOEXEC > > options. > > Please do break compatibility with a handful of old apps That's not only about old apps, but also a default relaxed policy for the toolchain: http://www.gentoo.org/proj/en/hardened/gnu-stack.xml > - but as a > non-default option (which we're likely to make the default on Owl, just > like we had non-executable stack by default with 2.4.x-ow kernels). > > With OpenVZ, it needs to be configurable per-container. For upstream linux the default policy is if no GNU_STACK present, the stack flags is defined by a constant. I think it makes sense for the upsteam to change it to per pid namespace, with the same default. A good idea! Thanks, -- Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.