9front - general discussion about 9front
 help / color / mirror / Atom feed
From: Amavect <amavect@gmail.com>
To: 9front@9front.org
Subject: Re: [9front] [PATCH] kernel: disallow executing from #| or #d
Date: Tue, 10 May 2022 23:21:47 -0500	[thread overview]
Message-ID: <0BBC7720-2562-4C73-9153-0A37CF503820@gmail.com> (raw)
In-Reply-To: <0718a4ed-dd38-06f5-2071-6d2ded50b7fa@posixcafe.org>

I think the correct thing to do is to get the devices to respect the permission bits,
potentially allowing execution if chmod made it that way. Also check rw bits.
This would make it more consistent to my judgement.
Then, we can decide whether to reject a wstat for trying to set the x bit.

Additionally, if you're restricting namespaces,
you pretty much have to set RFNOMNT.
This removes access to # directories.
Devpipe is rendered useless due to using attach messages (can still use pipe(2)),
while env and dup can still be pre-binded or not (like capabilities).

Thanks,
Amavect

  reply	other threads:[~2022-05-11  4:23 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-10  6:40 Jacob Moody
2022-05-10 14:40 ` ori
2022-05-10 16:34   ` Jacob Moody
2022-05-10 19:59     ` Amavect
2022-05-10 22:47       ` Jacob Moody
2022-05-11  4:21         ` Amavect [this message]
2022-05-11  6:31           ` Jacob Moody
2022-05-11 16:32             ` Amavect
2022-05-11 16:50               ` Jacob Moody
2022-05-15  2:43                 ` Amavect
2022-05-15 15:26                   ` Amavect
2022-05-15 16:28                     ` Jacob Moody
2022-05-10 20:52 ` [9front] " Anthony Martin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0BBC7720-2562-4C73-9153-0A37CF503820@gmail.com \
    --to=amavect@gmail.com \
    --cc=9front@9front.org \
    --subject='Re: [9front] [PATCH] kernel: disallow executing from #| or #d' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).