From owner-freebsd-security@FreeBSD.ORG  Wed Nov  2 15:41:26 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B7EBD16A41F
	for <freebsd-security@freebsd.org>;
	Wed,  2 Nov 2005 15:41:26 +0000 (GMT)
	(envelope-from db@traceroute.dk)
Received: from cicero0.cybercity.dk (cicero0.cybercity.dk [212.242.40.52])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2C00343D53
	for <freebsd-security@freebsd.org>;
	Wed,  2 Nov 2005 15:41:26 +0000 (GMT)
	(envelope-from db@traceroute.dk)
Received: from user3.cybercity.dk (user3.cybercity.dk [212.242.41.36])
	by cicero0.cybercity.dk (Postfix) with ESMTP
	id 1A81629F62; Wed,  2 Nov 2005 16:41:24 +0100 (CET)
Received: from trinita (port132.ds1-arsy.adsl.cybercity.dk [212.242.239.73])
	by user3.cybercity.dk (Postfix) with ESMTP
	id 91C2993C1A; Wed,  2 Nov 2005 16:41:23 +0100 (CET)
From: db <db@traceroute.dk>
To: "Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?=" <des@des.no>,
	freebsd-security@freebsd.org
Date: Wed, 2 Nov 2005 15:41:26 +0000
User-Agent: KMail/1.8.2
References: <200510270608.51571.db@traceroute.dk>
	<200510291412.57656.db@traceroute.dk> <86pspjz0xu.fsf@xps.des.no>
In-Reply-To: <86pspjz0xu.fsf@xps.des.no>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511021541.26986.db@traceroute.dk>
Cc: 
Subject: Re: Non-executable stack
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Nov 2005 15:41:26 -0000

On Wednesday 02 November 2005 12:30, you wrote:
> Not quite.  IA32 can make individual segments readable, writable and /
> or executable, but lacks the ability to do so on a per-page basis.
> Since we have trampoline code at the top of the stack, the entire
> stack segment must be executable.  Moving the trampoline off the stack
> would solve the problem on all platforms.
>
> W^X across the board is not an option - it would break HotSpot and
> other JIT-based software.

Ah I see, but how about making the patch without touching the trampoline code 
section? I'm not talking about doing it on all platforms (if ia32 sucks) or 
making it default, just to give us security minded admins and users a kernel 
option.

br
db