Re: [PATCH v3] devtmpfs: mount with noexec and nosuid

[Alan Cox]

> 	  This instructs the kernel to include the MS_NOEXEC and MS_NOSUID mount
> 	  flags when mounting devtmpfs.

So does a mount syscall

> 	  In-kernel separation of executable and non-executable code combined
> 	  with a proper executability policy is a basic technique to protect
> 	  against exploits by buggy or malicious code or hardware errors.  In
> 	  terms of overhead it is a low-cost-high-effect technique especially on
> 	  platforms with dedicated hardware support, e.g. x86_64 (look for "NX"
> 	  feature in BIOS settings).  Mounting devtmpfs with MS_NOEXEC flag is
> 	  an essential building-block for this security technique.

Which is done via a mount syscall

> 
> 	  Notice:  If enabled, software which depends on execution of
> 	  runtime-generated code can only be used with restricted feature set or
> 	  not at all, e.g. proprietary video drivers, JIT-compilers, most modern
> 	  web browsers.  The grsecurity-patchset provides exception mechanisms to
> 	  solve this problem for e.g. desktop systems.

We don't generally advertise random third party patches in Kconfig
> 
> 	  For server and embedded systems with HA-requirements consider Y.

That is totally misleading. HA has no connection to security and sever
and most embedded systems have nothing to gain from this feature as they
have both other writable storage and interpreters available. So if you
are attacking a server box you don't care about noexec, you feed the
script to perl.

NAK
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/