On Tue, May 25, 2010 at 09:11:09PM -0700, Kees Cook wrote: > Yes, the git URL for this is: > > git://kernel.ubuntu.com/kees/linux-2.6.git > Doesn't appear to work? kyle@dreadnought ~/src/linux-2.6 $ git remote add kees-execshield git://kernel.ubuntu.com/kees/linux-2.6.git kyle@dreadnought ~/src/linux-2.6 $ git fetch kees-execshield kernel.ubuntu.com[0: 91.189.94.216]: errno=Connection timed out fatal: unable to connect a socket (Connection timed out) > In looking at how "exec-shield" is used, I was thinking that maybe the > "nonexec" flag should be used instead. It could have multiple settings, > maybe. It seems like it could be used for: > > off > hw-only > emu-if-needed > > There also seems to be the "2" setting which ignores the stack-exec > markings, but that seems like it should be a separate feature. If we can > clean it up a little more, I'd really like to try to for upstream > inclusion. I know there has been resistance to it in the past, but > nearly every distro includes this patch set now; it's silly not to have it > upstream. > Yes, we've been saying for a while that the randomization stuff needs to be gutted from exec-shield. There is still a lot of work left cleaning up exec-shield, all the hooks are pretty out of order. > The second commit "x86: clean up nx-emu for ia32-only" adds a bunch more > #ifdef CONFIG_X86_32 around things, mostly I think the primary change in > behavior that would be visible to Fedora would be having the "exec-shield" > sysctl vanish on x86_64, and to fall back to mainline ASLR in the non-emu > case. > I suspect all this is still too invasive in the generic code to be palatable. > > > Is there a better place (public Fedora mailing list?) for me to send these? > > > > > > > fedora-kernel-list@xxxxxxxxxx if you want. > Cheers, Kyle _______________________________________________ kernel mailing list kernel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/kernel
