Re: [kernel-hardening] overview of PaX features

Solar Designer
2011-06-29T19:43:39Z

Vasiliy,

On Wed, Jun 29, 2011 at 10:37:28PM +0400, Vasiliy Kulikov wrote:
> That's not only about old apps, but also a default relaxed policy for
> the toolchain:
>
> http://www.gentoo.org/proj/en/hardened/gnu-stack.xml

Of course. In my experience, most programs that currently get
executable stack actually don't need it.

And for gcc trampolines we can include the emulation code in the kernel.

> For upstream linux the default policy is if no GNU_STACK present, the
> stack flags is defined by a constant. I think it makes sense for
> the upsteam to change it to per pid namespace, with the same default.

Sounds good. Then we'll have less code to maintain in our patch.

Thanks,

Alexander