Re: [PATCH] fexecve

[Thor Lancelot Simon <tls%panix.com@localhost>]

On Fri, Nov 16, 2012 at 11:31:20AM -0600, Eric Haszlakiewicz wrote:
> On Thu, Nov 15, 2012 at 07:39:03PM -0500, Thor Lancelot Simon wrote:
> > On Thu, Nov 15, 2012 at 05:18:04PM -0600, Eric Haszlakiewicz wrote:
> > > 
> > > Well setuid executables seem like a special case, but other than that, I
> > > think I can probably manage to execute something without an exec call.
> > > In fact I know I can, just by linking against any dynamic library and
> > > calling one of the functions in it.
> > 
> > You can't load a dynamic library that's on a filesystem mounted noexec.
> 
> er... so the dynamic linker looks like it tries to mmap the file with execute
> permissions, and that fails, but what's to prevent me from just reading the 
> file into memory and jumping to that address?  I feel like I'm missing 
> something here...

If it's not mapped MAP_EXEC, you can't jump there.  If you can, you either
have a hardware limitation that makes W^X impossible, or you have a pmap
bug.