Re: Stacking Openwall and SELinux?

crispinat_private

Seth Arnold wrote:

>On Mon, Apr 01, 2002 at 04:01:38PM -0500, David Wheeler wrote:
>
>>I'm thinking about things like the Non-executable stack,
>>temp directory limitations, etc.
>>
>I seem to recall that to implement non-exec stack in LSM would require
>page-level access granularity, which was rejected as probably too
>expensive (slow) for general use. However, I seem to recall that a chap
>named Antony was working on providing statistics on just how much slower
>the system would run with page-level granularity. I _think_ he provided
>full LMBench numbers, but I'm not great at reading those numbers. (If he
>wanted to post a 'make summary' output from lmbench, I might stand a
>better chance of understanding the impact. :)
>
Antony floated a proposal to either add page-level hooks, or remove the 
read/write syscall hooks. We (WireX & some others, IIRC) resisted the 
"remove read/write hooks" proposal because real projects use them, and 
work-arounds based on open hooks work only in limited circumstances.

I am interested in the page-level hooks, and encouraged Antony to 
continue. He implemented a page-level hook and posted LMBench data, but 
only in "raw" form, which made it hard to interpret the real impact of 
the hook. Requests to provide the full LMBench report went un-answered, 
and the thread died out.

If someone wants to contribute to LSM and doesn't have a project, it 
would be REALLY helpful to go find the page-level hook that Antony 
posted, and run it through LMBench and post the fully cooked results 
here. This will allow us to decide whether page-level hooks have a real 
performance impact. If the cost is small enough, I would support 
including page level hooks for the following benefits:

    * Enables no-exec stack module. Linus doesn't have to like the module :)
    * Solves an open security problem with fully mediating mmap()
    * Funky research: might even enable fun research with VM paging
      algorithms

But it all depends on the costs.  Need to measure carefully before this 
can go forward.

Crispin

-- 
Crispin Cowan, Ph.D.
Chief Scientist, WireX Communications, Inc. http://wirex.com
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module