Re: [Announcement] "Exec Shield", new Linux security feature

[Chuck Ebbert]

> btw, I guess that now, at least when X_workaround==1, exploits will focus
> on getting iopl(2) called before they get the actual shellcode called.
> In some cases it may be easy to cause a call to iopl (param doesn't matter
> as long as its not zero).

  I looked at sys_iopl() and it seems to be checking if its param is
> 3, so EBX on the stack must be 0x00000003 to set iopl to 3.

  The declaration is misleading ("unused"???:)

asmlinkage int sys_iopl(unsigned long unused)
{
        struct pt_regs * regs = (struct pt_regs *) &unused;       <== yuck!
        unsigned int level = regs->ebx;
        ...
        if (level > 3)
                return -EINVAL;

  Shouldnt it be like this?

asmlinkage int sys_iopl (struct pt_regs regs)
{
        unsigned int level = regs.ebx;
        ...

fork, clone, vfork and execve all declare it that way...