x86-merge has kind of thrown a spanner in the execshield patchset. I''ve merged it up so it looks like it works, but I''d like to get some input from others to make sure I didn''t brown-paper-bag it. The randomization bits seem to have been merged upstream, but I deferred to the execshield implementation since they had some differences. cheers, Kyle [linux-2.6-execshield.patch is attached.]
Your attachment was empty. The execshield patch has gotten much smaller than it was in the beginning. It still hasn''t gotten all the cleanup it could get though. The patch does a few different things that ideally would be in separate patches. 1. Segment-based PAGE_EXEC for no-NX hardware (and non-PAE 32-bit kernels). This is not really very much code. There''s the GPF trap handler, and the hooks like arch_add_exec_range et al. I don''t see why this couldn''t be merged upstream as a config option. 2. Tighter permissions on /proc/pid/foo. This would be simple to make a config option and is such a simple patch (fs/proc/base.c) it seems like it shouldn''t be hard to get upstream. 3. get_unmapped_area_prot. This is what changes the layouts and is the heart of what''s really "exec-shield" since randomization has been upstream. 4. Miscellaneous tweaks and cruft. There are strange little bits of diff that I don''t know the explanation for. Maybe we can clean these up. I hope Ingo knows what any other bits in there are for. Thanks, Roland
On Sun, Feb 10, 2008 at 08:43:32PM -0500, Kyle McMartin wrote:> x86-merge has kind of thrown a spanner in the execshield patchset. I''ve > merged it up so it looks like it works, but I''d like to get some input > from others to make sure I didn''t brown-paper-bag it. > > The randomization bits seem to have been merged upstream, but I deferred > to the execshield implementation since they had some differences. > > cheers, > Kyle > [linux-2.6-execshield.patch is attached.]i appear to have noviced it and truncated the patch. i remerged it against rc1... seems to work. i hope... cheers, kyle