Date: Fri, 23 Oct 2020 10:02:32 +0100 From: Catalin Marinas <catalin.marinas@....com> To: Kees Cook <keescook@...omium.org> Cc: Topi Miettinen <toiwoton@...il.com>, Szabolcs Nagy <szabolcs.nagy@....com>, Jeremy Linton <jeremy.linton@....com>, "linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>, libc-alpha@...rceware.org, systemd-devel@...ts.freedesktop.org, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, Mark Rutland <mark.rutland@....com>, Mark Brown <broonie@...nel.org>, Dave Martin <dave.martin@....com>, Will Deacon <will.deacon@....com>, Salvatore Mesoraca <s.mesoraca16@...il.com>, kernel-hardening@...ts.openwall.com, linux-hardening@...r.kernel.org Subject: Re: BTI interaction between seccomp filters in systemd and glibc mprotect calls, causing service failures On Thu, Oct 22, 2020 at 01:02:18PM -0700, Kees Cook wrote: > Regardless, it makes sense to me to have the kernel load the executable > itself with BTI enabled by default. I prefer gaining Catalin's suggested > patch. :) [...] >  https://lore.kernel.org/linux-arm-kernel/20201022093104.GB1229@gaia/ I think I first heard the idea at Mark R ;). It still needs glibc changes to avoid the mprotect(), or at least ignore the error. Since this is an ABI change and we don't know which kernels would have it backported, maybe better to still issue the mprotect() but ignore the failure. -- Catalin
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.