* Dave Hansen <dave@xxxxxxxx> wrote: > > If yes then this could be a significant security feature / usecase for pkeys: > > executable sections of shared libraries and binaries could be mapped with pkey > > access disabled. If I read the Intel documentation correctly then that should > > be possible. > > Agreed. I've even heard from some researchers who are interested in this: > > https://www.infsec.cs.uni-saarland.de/wp-content/uploads/sites/2/2014/10/nuernberger2014ccs_disclosure.pdf So could we try to add an (opt-in) kernel option that enables this transparently and automatically for all PROT_EXEC && !PROT_WRITE mappings, without any user-space changes and syscalls necessary? Beyond the security improvement, this would enable this hardware feature on most x86 Linux distros automatically, on supported hardware, which is good for testing. Assuming it boots up fine on a typical distro, i.e. assuming that there are no surprises where PROT_READ && PROT_EXEC sections are accessed as data. Thanks, Ingo -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>