Re: thoughts on kernel security issues

[Willy Tarreau]

On Wed, Jan 12, 2005 at 11:28:51PM -0800, Matt Mackall wrote:
> On Wed, Jan 12, 2005 at 08:48:57PM -0800, Linus Torvalds wrote:
> > 
> > 
> > On Wed, 12 Jan 2005, Dave Jones wrote:
> > > 
> > > For us thankfully, exec-shield has trapped quite a few remotely
> > > exploitable holes, preventing the above.
> > 
> > One thing worth considering, but may be abit _too_ draconian, is a
> > capability that says "can execute ELF binaries that you can write to".
> > 
> > Without that capability set, you can only execute binaries that you cannot
> > write to, and that you cannot _get_ write permission to (ie you can't be
> > the owner of them either - possibly only binaries where the owner is
> > root).
> 
> We can do that now with a combination of read-only and no-exec mounts.

That's why some hardened distros ship with everything R/O (except var) and
/var non-exec.

Willy

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/