Re: [Announcement] "Exec Shield", new Linux security feature

[Andi Kleen]

On Fri, May 02, 2003 at 01:56:44PM -0700, H. Peter Anvin wrote:
> Andi Kleen wrote:
> >>
> >>x86-64 definitely does, and it's the default on Linux/x86-64.
> > 
> > No we had to turn it off and now it's too late to turn it back on again.
> > There is also one bug left that prevents it.
> > 
> 
> Why is that?  And, in particular, why is it "too late to turn it back

mprotect() didn't (and probably still does not) work when you change
PROT_EXEC.

> on"?  It seems as long as it's clearly defined as the ABI that change
> can be made later, effectively as a bug fix.

The ABI leaves it undefined. But it does break binaries.

Also gcc needs to be fixed for trampolines (I had some code that enabled 
the stack exec in there, but it didn't work because of the mprotect
issues)

-Andi