Date: Sat, 13 Aug 2011 20:55:02 +0400 From: Vasiliy Kulikov <segoon@...nwall.com> To: kernel-hardening@...ts.openwall.com Subject: Re: 32/64 bitness restriction for pid namespace Solar, Some thoughts about prctl() approach. I've decided to go with 2 flags of prctl() - whether 32 bit executable is allowed on the next execve(), whether 64 bit exec is allowed. If set both, any bitness is allowed, and the bitness lock depends on the binary bitness. If none set, don't lock at all. Questions here: 1) If execve() fails, e.g. because of missing binary, drop the flag or keep it? I think dropping is safer. 2) If the binary is non-ELF, e.g. a misc binary? I think execve() should fail as we expect to run 64/32 bit ELF. Thanks, -- Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.