3 ms·

Very interesting read! During my training, I worked on a BIND4->BIND9 transition in a mainframe team and given the honourable task of looking for ways to make

by krylon 11y ago

Very interesting read! During my training, I worked on a BIND4->BIND9 transition in a mainframe team and given the honourable task of looking for ways to make the configuration more secure. I did quite a bit of reading back then, and I think I kind of remember reading something about z/Architecture having all the pieces in place to provide W^X-style memory protection, but the OS not using it (at least not z/OS). This article seems to say the opposite. Now I am confused if I mis-remember this detail or if the article I read back then was wrong. :-?

js8 11y ago
If anything didn't happen in the past couple years, the article is correct. z/Architecture doesn't have non-executable memory nor ASLR. The reason I think is in part that they don't have a free bit on each page descriptor to use. Also, many mainframe programs are really old, and some may still rely on self-modification in unknown ways. And having ASLR would (IMHO) make debugging really painful, because they still rely on assembler programs a lot. z/OS (which drives development of z/Architecture) is kind of Australia of operating systems. Early independent evolution -> lot of weird and backward stuff there.
- monocasa 11y ago
  >and some may still rely on self-modification in unknown ways To the point that they have the EX instruction. It's an indirect logical or and execute single instruction to allow for re enterent self modifying code. How can you even begin to W^X given that you have that instruction?
  - js8 11y ago
    I don't think EX typically accesses writable memory, so that wouldn't be a big problem (and hardware could actually enforce that target of EX is in executable storage). It's used as a workaround to have variable portion of instructions that aren't normally variable. The actual non-reentrant code is becoming less common, but it still happens sometimes. Although I think it could be possible to implement that writable pages cannot be executed via a special bit in PSW. Not sure about practical implications to z/OS, though.
- krylon 11y ago
  Thanks for the explanation!

by krylon 11y ago

js8 11y ago

If anything didn't happen in the past couple years, the article is correct. z/Architecture doesn't have non-executable memory nor ASLR. The reason I think is in part that they don't have a free bit on each page descriptor to use. Also, many mainframe programs are really old, and some may still rely on self-modification in unknown ways. And having ASLR would (IMHO) make debugging really painful, because they still rely on assembler programs a lot. z/OS (which drives development of z/Architecture) is kind of Australia of operating systems. Early independent evolution -> lot of weird and backward stuff there.

monocasa 11y ago
>and some may still rely on self-modification in unknown ways To the point that they have the EX instruction. It's an indirect logical or and execute single instruction to allow for re enterent self modifying code. How can you even begin to W^X given that you have that instruction?
- js8 11y ago
  I don't think EX typically accesses writable memory, so that wouldn't be a big problem (and hardware could actually enforce that target of EX is in executable storage). It's used as a workaround to have variable portion of instructions that aren't normally variable. The actual non-reentrant code is becoming less common, but it still happens sometimes. Although I think it could be possible to implement that writable pages cannot be executed via a special bit in PSW. Not sure about practical implications to z/OS, though.
krylon 11y ago
Thanks for the explanation!