Hi, On Thu, 22 Oct 2020 at 23:24, Topi Miettinen <toiwoton@xxxxxxxxx> wrote: > SARA looks interesting. What is missing is a prctl() to enable all W^X > protections irrevocably for the current process, then systemd could > enable it for services with MemoryDenyWriteExecute=yes. SARA actually has a procattr[0] interface to do just that. There is also a library[1] to help using it. > I didn't also see specific measures against memfd_create() or file > system W&X, but perhaps those can be added later. You are right, there are no measures against those vectors. It would be interesting to add them, though. > Maybe pkey_mprotect() > is not handled either unless it uses the same LSM hook as mprotect(). IIRC mprotect is implemented more or less as a pkey_mprotect with -1 as pkey. The same LSM hook should cover both. Salvatore [0] https://lore.kernel.org/lkml/1562410493-8661-10-git-send-email-s.mesoraca16@xxxxxxxxx/ [1] https://github.com/smeso/libsara
