3 ms·
Couldn't or shouldn't each parser be run in a container with systemd-nspawn or LXC or another container runtime? (Even if all it's doing is reading a file forma
by westurner 2y ago
Couldn't or shouldn't each parser be run in a container with systemd-nspawn or LXC or another container runtime? (Even if all it's doing is reading a file format into process space as NX data not code as the current user)
- westurner 2y agoNX bit: https://en.wikipedia.org/wiki/NX_bit https://en.wikipedia.org/wiki/NX_bit Executable-space protection > Limitations mentions JITs and ROP: https://en.wikipedia.org/wiki/Executable-space_protection https://en.wikipedia.org/wiki/Executable-space_protection mprotect(), VirtualAlloc[Ex] and VirtualProtect[Ex], "NX bit: does it protect the stack?" https://security.stackexchange.com/questions/47807/nx-bit-does-it-protect-the-stack https://security.stackexchange.com/questions/47807/nx-bit-do...