diff options
| author | Andrew Morton <akpm@osdl.org> | 2004-04-11 23:24:57 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2004-04-11 23:24:57 -0700 |
| commit | 01cc53b25e1883ff537d19adc87097e1833deeaa (patch) | |
| tree | 22cdee00962ea30322c44abe594e3ef0489da752 /fs/exec.c | |
| parent | 492361a6d915137590a8eba787dd878d71137358 (diff) | |
[PATCH] Non-Exec stack support
From: Kurt Garloff <garloff@suse.de>
A patch to parse the elf binaries for a PT_GNU_STACK section to set the stack
non-executable if possible. Most parts have been shamelessly stolen from
Ingo Molnar's more ambitious stackshield
http://people.redhat.com/mingo/exec-shield/exec-shield-2.6.4-C9
The toolchain has meanwhile support for marking the binaries with a
PT_GNU_STACK section wwithout x bit as needed.
If no such section is found, we leave the stack to whatever the arch defaults
to. If there is one, we explicitly disabled the VM_EXEC bit if no x bit is
found, otherwise explicitly enable.
Diffstat (limited to 'fs/exec.c')
| -rw-r--r-- | fs/exec.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/fs/exec.c b/fs/exec.c index 62bf2c537abd..26e3392b6369 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -342,7 +342,7 @@ out_sig: return; } -int setup_arg_pages(struct linux_binprm *bprm) +int setup_arg_pages(struct linux_binprm *bprm, int executable_stack) { unsigned long stack_base; struct vm_area_struct *mpnt; @@ -425,8 +425,16 @@ int setup_arg_pages(struct linux_binprm *bprm) mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p; mpnt->vm_end = STACK_TOP; #endif - mpnt->vm_page_prot = protection_map[VM_STACK_FLAGS & 0x7]; - mpnt->vm_flags = VM_STACK_FLAGS; + /* Adjust stack execute permissions; explicitly enable + * for EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X + * and leave alone (arch default) otherwise. */ + if (unlikely(executable_stack == EXSTACK_ENABLE_X)) + mpnt->vm_flags = VM_STACK_FLAGS | VM_EXEC; + else if (executable_stack == EXSTACK_DISABLE_X) + mpnt->vm_flags = VM_STACK_FLAGS & ~VM_EXEC; + else + mpnt->vm_flags = VM_STACK_FLAGS; + mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7]; mpnt->vm_ops = NULL; mpnt->vm_pgoff = 0; mpnt->vm_file = NULL; |