3 ms·
> "the"? Now you are just nitpicking :) "the" meaning, you gave me an example. > If you're executing in kernel mode,.....Grsec/PaX kernel, however. SELinux h
by lholden 13y ago
> "the"?
Now you are just nitpicking :) "the" meaning, you gave me an example.
> If you're executing in kernel mode,.....Grsec/PaX kernel, however.
SELinux has a lot of overlap with grsec providing many of the same benefits while being more widely available. The flow of an exploit: 1) entry into a system (app compromise, shell access), 2) inserting/uploading of executable data, 3) execution of said data granting further access (Ex, exploiting a kernel bug, adding a backdoor, manipulating the host system in some way).
The goals of Grsec/SELinux, and marking data memory as non execute (NX bit, PaX, Exec Shield) are aimed at preventing #2 and #3. The idea is the prevention of access escalation in the first place.
On PaX, the kernel supports utilizing the NX bit on x86-64 and has for quite a while now. Not using a system supporting the NX bit or at least PaX/Exec Shield is pretty stupid.
> But there's a reasonable level of security you can achieve that's far beyond what docker provides
I had already agreed with you on VMs... no reason to argue this point. :) Since you mention VMs again however, I will also note that VMs are not entirely isolated from the host system. A Xen (as your example) exploit as an example: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html http://lists.xen.org/archives/html/xen-announce/2012-06/msg0...
- zx2c4 13y ago> you gave me an example. Ahh sorry. Well to continue along that example, evidently it breaks out of lots of things -- https://grsecurity.net/~spender/logs.txt https://grsecurity.net/~spender/logs.txt > On PaX, the kernel supports utilizing the NX bit on x86-64 and has for quite a while now. Not using a system supporting the NX bit or at least PaX/Exec Shield is pretty stupid. Not going to try to parse this, but you appear to be very mistaken. Wikipedia PaX. > VMs are not entirely isolated from the host system Correct, hence the parenthetical in the OP. That sysret bug was a great one.
- lholden 13y ago> Not going to try to parse this, but you appear to be very mistaken. Wikipedia PaX. On PaX https://en.wikipedia.org/wiki/PaX#Executable_space_protections https://en.wikipedia.org/wiki/PaX#Executable_space_protectio... "The major feature of PaX is the executable space protection it offers. These protections take advantage of the NX bit on certain processors to prevent the execution of arbitrary code. This staves off attacks involving code injection or shellcode. On IA-32 CPUs where there is no NX bit, PaX can emulate the functionality of one in various ways." And then on NX bit support on Linux: https://en.wikipedia.org/wiki/NX_bit#Linux https://en.wikipedia.org/wiki/NX_bit#Linux "The Linux kernel currently supports the NX bit on x86-64 CPUs and on x86 processors that implement it, such as the current 64-bit CPUs of AMD, Intel, Transmeta and VIA. The support for this feature in the 64-bit mode on x86-64 CPUs was added in 2004 by Andi Kleen, and later the same year, Ingo Molnar added support for it in 32-bit mode on 64-bit CPUs. These features have been in the stable Linux kernel since release 2.6.8 in August 2004." PaX also provides a few other features but the big defining one has been the NX bit support. Not sure why you seem to think I am mistaken in what I said.