Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Jun 2017 19:49:13 +0200
From: Jann Horn <>
To: Salvatore Mesoraca <>
Cc: kernel list <>,, 
	Kernel Hardening <>, 
	Brad Spengler <>, PaX Team <>, 
	Casey Schaufler <>, Kees Cook <>, 
	James Morris <>, "Serge E. Hallyn" <>
Subject: Re: [PATCH 01/11] S.A.R.A. Documentation

On Mon, Jun 12, 2017 at 6:56 PM, Salvatore Mesoraca
<> wrote:
> Adding documentation for S.A.R.A. LSM.
> Signed-off-by: Salvatore Mesoraca <>
> +/proc/PID/attr/sara/wxprot interface
> +------------------------------------
> +The `procattr` interface can be used by a program to discover which
> +WX Protection features are enabled and/or to tighten them: protection
> +can't be softened via procattr.
> +The interface is simple: it's a text file with an hexadecimal
> +number in it representing enabled features (more information can be
> +found in the `Flags values`_ section). Via this interface it is also
> +possible to perform a complete memory scan to remove the write permission
> +from pages that are both writable and executable.
> +
> +Protections that prevent the runtime creation of executable code
> +can be troublesome for all those programs that actually need to do it
> +e.g. programs shipping with a JIT compiler built-in.
> +Given that it's possible to segregate the part that runs untrusted
> +code from the rest through a fork, this feature can be use to run the JIT
> +compiler with few restrictions while enforcing full WX Protection in the
> +rest of the program.

As far as I can tell, the wxprot interface in procfs, when used as
/proc/PID/attr/sara/wxprot, actually only sets restrictions on one of the
The documentation doesn't seem to mention this.

> +.. [3] `saralib                <>`_

This link is broken.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.