Re: mmap_min_addr and your local LSM (ok, just SELinux)

[Andi Kleen <andi@firstfloor.org>]

On Tue, Jul 28, 2009 at 11:00:28AM +0100, Alan Cox wrote:
> On Tue, 28 Jul 2009 11:21:29 +0200
> Andi Kleen <andi@firstfloor.org> wrote:
> 
> > Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
> > 
> > > A dumb question perhaps, but while addling my brain over the tty layer I
> > > was wondering if for the specific case of jump through NULL (which seems
> > > to be the most common but by no means only problem case that gets
> > > exploited) is there any reason we can't set a default breakpoint for
> > 
> > You mean a hardware breakpoint? Hardware break points are a precious
> > scarce resource. The people who rely on them would be likely
> > unhappy if you take one way from them.
> 
> They are a tiny minority and could always turn such protection off.

"I don't use it so I don't care"

... in addition it doesn't help anyways because the x86 hardware
breakpoints can only trap an upto 4-8 bytes area. So if you set that
to 0 then a reference to >8(%reg),%reg==0 wouldn't trap.

That's a pretty common case with

	x->member

where offsetof(..,, member) >= 8 (or 4 on 32bit)

Was very likely even the case on the original exploit.

If you use all available break points (making all gdb users unhappy)
then you could still only cover 64 bytes on 64bit, 32 on 32bit.

-Andi

-- 
ak@linux.intel.com -- Speaking for myself only.