Date: Sun, 27 Sep 2009 11:55:58 -0700 From: Julian Elischer <julian@elischer.org> To: "Simon L. Nielsen" <simon@FreeBSD.org> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r197537 - head/sys/vm Message-ID: <4ABFB53E.6010702@elischer.org> In-Reply-To: <4ABFB4D1.5070505@elischer.org> References: <200909271449.n8REnpUX027608@svn.freebsd.org> <4ABFB4D1.5070505@elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Julian Elischer wrote: > Simon L. Nielsen wrote: >> Author: simon >> Date: Sun Sep 27 14:49:51 2009 >> New Revision: 197537 >> URL: http://svn.freebsd.org/changeset/base/197537 >> >> Log: >> Do not allow mmap with the MAP_FIXED argument to map at address zero. >> This is done to make it harder to exploit kernel NULL pointer security >> vulnerabilities. While this of course does not fix vulnerabilities, >> it does mitigate their impact. >> Note that this may break some applications, most likely emulators or >> similar, which for one reason or another require mapping memory at >> zero. > > If you are going to take this approach then it shuel be enabled by > a bit in the inherrited process permissions, with a toll to set it, > like: > > map0 {command} > where command could be something like "wine". > use setfib or nice as a template for the tool. > > this way only processes that need it are affected. > (of course only root can run the program or set the bit)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4ABFB53E.6010702>