kernel-hardening - Re: How about just O_EXEC? (was Re: [PATCH v5 3/6] fs: Enable to enforce noexec mounts or file exec through O

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ftbxg0ut.fsf@oldenburg2.str.redhat.com>
Date: Mon, 18 May 2020 09:26:34 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Kees Cook <keescook@...omium.org>
Cc: Mickaël Salaün <mic@...ikod.net>,  Al Viro
 <viro@...iv.linux.org.uk>,
  Aleksa Sarai <cyphar@...har.com>,  Andy Lutomirski <luto@...nel.org>,
  Mimi Zohar <zohar@...ux.ibm.com>,  Stephen Smalley
 <stephen.smalley.work@...il.com>,  Christian Heimes
 <christian@...hon.org>,  Deven Bowers <deven.desai@...ux.microsoft.com>,
  Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>,  John Johansen
 <john.johansen@...onical.com>,  Kentaro Takeda <takedakn@...data.co.jp>,
  "Lev R. Oshvang ." <levonshe@...il.com>,  Alexei Starovoitov
 <ast@...nel.org>,  Daniel Borkmann <daniel@...earbox.net>,  Eric Chiang
 <ericchiang@...gle.com>,  James Morris <jmorris@...ei.org>,  Jan Kara
 <jack@...e.cz>,  Jann Horn <jannh@...gle.com>,  Jonathan Corbet
 <corbet@....net>,  Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>,
  Matthew Garrett <mjg59@...gle.com>,  Matthew Wilcox
 <willy@...radead.org>,  Michael Kerrisk <mtk.manpages@...il.com>,
  Mickaël Salaün <mickael.salaun@....gouv.fr>,
  Philippe Trébuchet
 <philippe.trebuchet@....gouv.fr>,  Scott Shell <scottsh@...rosoft.com>,
  Sean Christopherson <sean.j.christopherson@...el.com>,  Shuah Khan
 <shuah@...nel.org>,  Steve Dower <steve.dower@...hon.org>,  Steve Grubb
 <sgrubb@...hat.com>,  Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,
  Vincent Strubel <vincent.strubel@....gouv.fr>,  linux-kernel
 <linux-kernel@...r.kernel.org>,  kernel-hardening@...ts.openwall.com,
  linux-api@...r.kernel.org,  linux-integrity@...r.kernel.org,  LSM List
 <linux-security-module@...r.kernel.org>,  Linux FS Devel
 <linux-fsdevel@...r.kernel.org>
Subject: Re: How about just O_EXEC? (was Re: [PATCH v5 3/6] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC)

* Kees Cook:

> I think I misunderstood what you meant (MickaÃ«l got me sorted out
> now). If O_EXEC is already meant to be "EXEC and _not_ READ nor WRITE",
> then yes, this new flag can't be O_EXEC. I was reading the glibc
> documentation (which treats it as a permission bit flag, not POSIX,
> which treats it as a complete mode description).

I see.  I think this part of the manual is actually very Hurd-specific
(before the O_ACCMODE description).  I'll see if I can make this clearer
in the markup.

Thanks,
Florian

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.