On Thu, 6 Nov 2003 [EMAIL PROTECTED] wrote: > [...] incidentally, if i were to make use of PT_GNU_STACK in PaX, i > could claim the same - now what was your point of fighting this silly > issue?
yes, this was precisely my point to discuss this issue. Executability of the stack is not some divine privilege given to the sacred few, distributed via matters of public policy determined by the ruler of the system, it's simply a property of the code written. The system ought to detect it automatically and not stand in the way. We implemented the code for this - and the compiler, toolchain and glibc supports it all across. If PaX makes use of PT_GNU_STACK [just take the binfmt_elf.c bits] then this portion of PaX will conform to the Linus rule too. This is not some magic property only attached to exec-shield. this is i believe the main goal, in the quest to bring security to the average user. The only way to do that is to concentrate all technology on making security as automatic and hassle-free as possible. i hope we've finally settled this issue, right? You might still think of me in unfavorable terms but i've got to live with that :-) > by the way, on another look at your patch i noticed the following: > > 1. you added a new parameter to fs/binfmt_elf.c:create_elf_tables() > but don't make use of it, probably it's not needed at all now. > > 2. in fs/exec.c:setup_arg_pages() you may create an inconsistent state > between mpnt->vm_page_prot and mpnt->vm_flags, the former should > be derived from the latter, just like do_mmap_pgoff() does it. thanks, i'll fix these! Ingo