On Mon, Jun 12, 2017 at 6:56 PM, Salvatore Mesoraca
[off-list ref] wrote:

Adding documentation for S.A.R.A. LSM.

Signed-off-by: Salvatore Mesoraca <redacted>

[...]

+/proc/PID/attr/sara/wxprot interface
+------------------------------------
+The `procattr` interface can be used by a program to discover which
+WX Protection features are enabled and/or to tighten them: protection
+can't be softened via procattr.
+The interface is simple: it's a text file with an hexadecimal
+number in it representing enabled features (more information can be
+found in the `Flags values`_ section). Via this interface it is also
+possible to perform a complete memory scan to remove the write permission
+from pages that are both writable and executable.
+
+Protections that prevent the runtime creation of executable code
+can be troublesome for all those programs that actually need to do it
+e.g. programs shipping with a JIT compiler built-in.
+Given that it's possible to segregate the part that runs untrusted
+code from the rest through a fork, this feature can be use to run the JIT
+compiler with few restrictions while enforcing full WX Protection in the
+rest of the program.

As far as I can tell, the wxprot interface in procfs, when used as
/proc/PID/attr/sara/wxprot, actually only sets restrictions on one of the
threads.
The documentation doesn't seem to mention this.

+.. [3] `saralib                <https://github.com/smeso/saralib>`_

This link is broken.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html