On Tue, May 19, 2020 at 12:41:27PM -0500, Eric W. Biederman wrote: > Kees Cook <keescook@xxxxxxxxxxxx> writes: > > and given the LSM hooks, I think the noexec check is too late as well. > > (This is especially true for the coming O_MAYEXEC series, which will > > absolutely need those tests earlier as well[1] -- the permission checking > > is then in the correct place: during open, not exec.) I think the only > > question is about leaving the redundant checks in fs/exec.c, which I > > think are a cheap way to retain a sense of robustness. > > The trouble is when someone passes through changes one of the permission > checks for whatever reason (misses that they are duplicated in another > location) and things then fail in some very unexpected way. Do you think this series should drop the "late" checks in fs/exec.c? Honestly, the largest motivation for me to move the checks earlier as I've done is so that other things besides execve() can use FMODE_EXEC during open() and receive the same sanity-checking as execve() (i.e the O_MAYEXEC series -- the details are still under discussion but this cleanup will be needed regardless). -- Kees Cook
