[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 13 Aug 2011 20:55:02 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: kernel-hardening@...ts.openwall.com
Subject: Re: 32/64 bitness restriction for pid namespace
Solar,
Some thoughts about prctl() approach.
I've decided to go with 2 flags of prctl() - whether 32 bit executable
is allowed on the next execve(), whether 64 bit exec is allowed. If set
both, any bitness is allowed, and the bitness lock depends on the binary
bitness. If none set, don't lock at all.
Questions here:
1) If execve() fails, e.g. because of missing binary, drop the flag or
keep it? I think dropping is safer.
2) If the binary is non-ELF, e.g. a misc binary? I think execve()
should fail as we expect to run 64/32 bit ELF.
Thanks,
--
Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
