On 18.03.2015 12:57, Kirill A. Shutemov wrote:
On Wed, Mar 18, 2015 at 11:30:40AM +0300, Konstantin Khlebnikov wrote:
From: Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx>
Each user gets private copy of the code thus nobody will be able to exploit
pages in the page cache. This works for statically-linked binaries. Shared
libraries are still vulnerable, but setting suid bit will protect them too.
Hm. Do we have suid/sgid semantic defiend for non-executables?
To me we should do this for all file private mappings of the suid process
or don't do it at all.
Yeah, this patch doesn't provide full protection.
That's just a proof-of-concept.
And what about forked suid process which dropped privilages. We still have
code pages shared.
User can get access to that private copy later but new suid
applications will get their own copy at exec.
Original page-cache pages are never exposed in pte.
I don't think it worth it. The only right way to fix the problem is ECC
memory.
ECC seems good protection until somebody figure out how to break it too.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>