3 ms·
Since we're on the topic. I wish they would at least create an option that makes the javascript part operate in a way that I don't have to disable PaX on Firefo
by okasaki 13y ago
Since we're on the topic. I wish they would at least create an option that makes the javascript part operate in a way that I don't have to disable PaX on Firefox. It is both the most critical desktop application to be protected and one of the very few that can't be. Even X.Org works fine with PaX these days.
- gphilip 13y agoWhat is PaX?
- aaronem 13y ago"PaX is a patch for the Linux kernel that implements least privilege protections for memory pages. The least-privilege approach allows computer programs to do only what they have to do in order to be able to execute properly, and nothing more. PaX was first released in 2000." [1] [1] http://en.wikipedia.org/wiki/PaX http://en.wikipedia.org/wiki/PaX
- KMag 13y agoPaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that no JITs are compatible with PaX. Not allowing pages to be simultaneously executable and writable has a lot of merit, but the stricter restrictions of PaX are a hard sell. It would be nice if PaX had an option to just disallow pages that are simultaneously writable and executable. It would be interesting to see a model where processes that were very restricted via the Linux Capabilities framework were allowed to execute pages that were once (but no longer) writable. This would allow programs such as browsers to run JITs in OS-level sandboxes. Edit: actually, I wonder if PaX allows shared pages that are executable in one process and writable in another. That would be another interesting model.