selinux execmem and sigaltstack

[Adam Goode]

Hi,

I am trying to figure out how to properly allocate memory for
sigaltstack in all cases. This is for MLton, which I maintain in Fedora.

Here is the problem: originally, MLton was not using PROT_EXEC for areas
of memory used with sigaltstack. This was causing parisc to fail, since
it uses trampolines on the stack.

http://mlton.org/pipermail/mlton/2004-December/026512.html

Now Fedora 9 tightens the default selinux booleans and by default
mprotect with PROT_EXEC will fail. I want to fix MLton upstream to work
correctly. Should I special case systems that require PROT_EXEC? Or is
there a more correct way to allocate memory for it?

Might this mean that sigaltstack() programs under SELinux on certain
architectures must run in unconfined_u:object_r:unconfined_execmem_exec_t ?



Thanks,

Adam

[Kevin Kofler]

Adam Goode <adam <at> spicenitz.org> writes:
>  Now Fedora 9 tightens the default selinux booleans and by default
>  mprotect with PROT_EXEC will fail. I want to fix MLton upstream to work 
Ouch, executable stacks are evil, the only reason you got away with it until 
now is that it is a custom stack being allocated that way (the system-allocated 
stack falls under "execstack" which is already banned by SELinux, with few 
exceptions).

>  correctly. Should I special case systems that require PROT_EXEC? Or
> is 
Maybe the GCC and glibc folks (Jakub Jelinek, Ulrich Drepper, ...) can tell you 
more, but IMHO special-casing the broken systems is the right thing to do if 
you want to get the patch upstream. For a quick fix, in Fedora, you should be 
able to simply patch out the PROT_EXEC entirely, parisc isn't a Fedora 
architecture anyway.

        Kevin Kofler

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Adam Goode wrote:
>  Now Fedora 9 tightens the default selinux booleans and by default
>  mprotect with PROT_EXEC will fail. I want to fix MLton upstream to work
>  correctly. Should I special case systems that require PROT_EXEC? Or is
>  there a more correct way to allocate memory for it? 
No, just special-case the broken architectures.  People using such
machines should already know that they are playing with fire.


>  Might this mean that sigaltstack() programs under SELinux on certain
>  architectures must run in unconfined_u:object_r:unconfined_execmem_exec_t ? 
If trampolines are regularly used, then you already have to special-case
the use of execstack for those archs and no other (hopefully).  In that
case just add execmem as well.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
>
> iD8DBQFHuIsy2ijCOnn/RHQRAuQiAKCyZaCCCO0n1zurTySWNXeWDCXZHwCgrASd
> mEm+GbvayLpXP/t1FdAE/60=
> =Unnh
> -----END PGP SIGNATURE-----