3 ms·
It lets you execute files even with no writeable filesystem , which could be useful exploiting a locked down system. It is also an argument that locking down pr
by justincormack 7y ago
It lets you execute files even with no writeable filesystem , which could be useful exploiting a locked down system. It is also an argument that locking down programs with no writeable fs is not sufficient for security.
The memfd api has lots of other uses, the fact you can exec is just a byproduct.
- the8472 7y ago> It is also an argument that locking down programs with no writeable fs is not sufficient for security. It is in fact silly since write and execute are orthogonal. You can mount a filesystem as noexec. Although memfd does put a bullet into W^X aspirations.