Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

dgaudet-list-linux-kernel@arctic.org
Tue, 4 Aug 1998 15:08:42 -0700 (PDT)


On Tue, 4 Aug 1998, David S. Miller wrote:

> From: dgaudet-list-linux-kernel@arctic.org
> Date: Tue, 4 Aug 1998 14:43:15 -0700 (PDT)
>
> libc is remapped by the patch so that the most significant byte of
> the addresses are 0.
>
> Keep in mind that for some people, mappable address space size is a
> treasured reasource. Or is it only done for libc.so?

>From the patch itself:

+#if defined(CONFIG_SECURE_STACK) && defined(CONFIG_BINFMT_ELF)
+extern struct linux_binfmt elf_format;
+#define MMAP_SEARCH_START ( \
+ current->binfmt == &elf_format && \
+ !(current->flags & PF_STACKEXEC_F) \
+ ? 0x00110000UL \
+ : TASK_SIZE / 3 )
+#else
#define MMAP_SEARCH_START (TASK_SIZE/3)
+#endif

It leaves the entire address space mappable. It just starts at a lower
address.

Dean

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html