[PATCH v3 0/5] Add support for RESOLVE_MAYEXEC
Florian Weimer
fw at deneb.enyo.de
Tue Apr 28 21:20:20 UTC 2020
* Jann Horn:
> Just as a comment: You'd probably also have to use RESOLVE_MAYEXEC in
> the dynamic linker.
Absolutely. In typical configurations, the kernel does not enforce
that executable mappings must be backed by files which are executable.
It's most obvious with using an explicit loader invocation to run
executables on noexec mounts. RESOLVE_MAYEXEC is much more useful
than trying to reimplement the kernel permission checks (or what some
believe they should be) in userspace.
More information about the Linux-security-module-archive
mailing list