Re: [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Mickaël Salaün <mic@xxxxxxxxxxx>
Subject: Re: [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC
From: James Morris <jmorris@xxxxxxxxx>
Date: Sat, 2 May 2020 04:05:53 +1000 (AEST)
Cc: linux-kernel@xxxxxxxxxxxxxxx, Aleksa Sarai <cyphar@xxxxxxxxxx>, Alexei Starovoitov <ast@xxxxxxxxxx>, Al Viro <viro@xxxxxxxxxxxxxxxxxx>, Andy Lutomirski <luto@xxxxxxxxxx>, Christian Heimes <christian@xxxxxxxxxx>, Daniel Borkmann <daniel@xxxxxxxxxxxxx>, Deven Bowers <deven.desai@xxxxxxxxxxxxxxxxxxx>, Eric Chiang <ericchiang@xxxxxxxxxx>, Florian Weimer <fweimer@xxxxxxxxxx>, Jan Kara <jack@xxxxxxx>, Jann Horn <jannh@xxxxxxxxxx>, Jonathan Corbet <corbet@xxxxxxx>, Kees Cook <keescook@xxxxxxxxxxxx>, Matthew Garrett <mjg59@xxxxxxxxxx>, Matthew Wilcox <willy@xxxxxxxxxxxxx>, Michael Kerrisk <mtk.manpages@xxxxxxxxx>, Mickaël Salaün <mickael.salaun@xxxxxxxxxxx>, Mimi Zohar <zohar@xxxxxxxxxxxxx>, Philippe Trébuchet <philippe.trebuchet@xxxxxxxxxxx>, Scott Shell <scottsh@xxxxxxxxxxxxx>, Sean Christopherson <sean.j.christopherson@xxxxxxxxx>, Shuah Khan <shuah@xxxxxxxxxx>, Steve Dower <steve.dower@xxxxxxxxxx>, Steve Grubb <sgrubb@xxxxxxxxxx>, Thibaut Sautereau <thibaut.sautereau@xxxxxxxxxxx>, Vincent Strubel <vincent.strubel@xxxxxxxxxxx>, kernel-hardening@xxxxxxxxxxxxxxxxxx, linux-api@xxxxxxxxxxxxxxx, linux-security-module@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx
In-reply-to: <d1a81d06-7530-1f2b-858a-e42bc1ae2a7e@digikod.net>
User-agent: Alpine 2.21 (LRH 202 2017-01-01)

On Fri, 1 May 2020, Mickaël Salaün wrote:

> 
> However, for fully controlled distros such as CLIP OS, it make sense to
> enforce such restrictions at kernel build time. I can add an alternative
> kernel configuration to enforce a particular policy at boot and disable
> this sysctl.

Sounds good.

-- 
James Morris
<jmorris@xxxxxxxxx>

References:
- [PATCH v3 0/5] Add support for RESOLVE_MAYEXEC
  - From: Mickaël Salaün
- [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC
  - From: Mickaël Salaün
- Re: [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC
  - From: James Morris
- Re: [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC
  - From: Mickaël Salaün

Prev by Date: Re: [PATCH v3] eventfd: convert to f_op->read_iter()
Next by Date: Re: [RFC 02/20] ext4: Introduce percpu seq counter for freeing blocks(PA) to avoid ENOSPC err
Previous by thread: Re: [PATCH v3 3/5] fs: Enable to enforce noexec mounts or file exec through RESOLVE_MAYEXEC
Next by thread: [PATCH v3 5/5] doc: Add documentation for the fs.open_mayexec_enforce sysctl
Index(es):
- Date
- Thread

[Index of Archives] [Linux Ext4 Filesystem] [Union Filesystem] [Filesystem Testing] [Ceph Users] [Ecryptfs] [AutoFS] [Kernel Newbies] [Share Photos] [Security] [Netfilter] [Bugtraq] [Yosemite News] [MIPS Linux] [ARM Linux] [Linux Security] [Linux Cachefs] [Reiser Filesystem] [Linux RAID] [Samba] [Device Mapper] [CEPH Development]