From owner-freebsd-security@FreeBSD.ORG  Fri Nov  4 00:11:35 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D9AC916A41F
	for <freebsd-security@freebsd.org>;
	Fri,  4 Nov 2005 00:11:35 +0000 (GMT)
	(envelope-from freebsd-security@m.gmane.org)
Received: from ciao.gmane.org (main.gmane.org [80.91.229.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5D51D43D46
	for <freebsd-security@freebsd.org>;
	Fri,  4 Nov 2005 00:11:35 +0000 (GMT)
	(envelope-from freebsd-security@m.gmane.org)
Received: from root by ciao.gmane.org with local (Exim 4.43)
	id 1EXpAS-0004Ty-QW
	for freebsd-security@freebsd.org; Fri, 04 Nov 2005 01:10:52 +0100
Received: from r5k101.chello.upc.cz ([86.49.10.101])
	by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-security@freebsd.org>; Fri, 04 Nov 2005 01:10:52 +0100
Received: from martinkov by r5k101.chello.upc.cz with local (Gmexim 0.1
	(Debian)) id 1AlnuQ-0007hv-00
	for <freebsd-security@freebsd.org>; Fri, 04 Nov 2005 01:10:52 +0100
X-Injected-Via-Gmane: http://gmane.org/
To: freebsd-security@freebsd.org
From: martinko <martinkov@pobox.sk>
Date: Fri, 04 Nov 2005 00:39:54 +0100
Lines: 37
Message-ID: <dke74a$ebb$2@sea.gmane.org>
References: <200510270608.51571.db@traceroute.dk>	<200510291242.16461.db@traceroute.dk>	<20051029131519.GA22254@ada.devbox.be>	<200510291412.57656.db@traceroute.dk>	<86pspjz0xu.fsf@xps.des.no>
	<43690E40.5040705@elischer.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-Complaints-To: usenet@sea.gmane.org
X-Gmane-NNTP-Posting-Host: r5k101.chello.upc.cz
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.12) Gecko/20050925
X-Accept-Language: sk, cs, en-gb, en-us, en
In-Reply-To: <43690E40.5040705@elischer.org>
Sender: news <news@sea.gmane.org>
Subject: Re: Non-executable stack
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Nov 2005 00:11:36 -0000

Julian Elischer wrote:
> Dag-Erling Smørgrav wrote:
> 
>> db <db@traceroute.dk> writes:
>>  
>>
>>> Memory on ia32 can be writable and readable.  When it is readable it
>>> is also executable.  On other arch's like AMD64 and IA64, I believe
>>> memory can be readable, writable and executable.
>>>   
>>
>>
>> Not quite.  IA32 can make individual segments readable, writable and /
>> or executable, but lacks the ability to do so on a per-page basis.
>> Since we have trampoline code at the top of the stack, the entire
>> stack segment must be executable.  Moving the trampoline off the stack
>> would solve the problem on all platforms.
>>  
>>
> 
> There has been recent talk of a shared kernel/user memory page..
> that could be used for trampoline code.
> 
>> W^X across the board is not an option - it would break HotSpot and
>> other JIT-based software.
>>
>> DES
>>  
>>
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
> 
> 

and what exactly is that trampoline btw/pls ?