]> git.ipfire.org Git - people/ms/linux.git/commit - fs/exec.c
exec: Use sane stack rlimit under secureexec
authorKees Cook <keescook@chromium.org>
Tue, 18 Jul 2017 22:25:35 +0000 (15:25 -0700)
committerKees Cook <keescook@chromium.org>
Tue, 1 Aug 2017 19:03:14 +0000 (12:03 -0700)
commit64701dee4178eb4a771b8b36cd86560f5b0e2460
tree1a0012699f1c5ba4fb7909eb0db75aaf10168e7a
parent473d89639db0aaa0799616b397584ba4f58cd8e1
exec: Use sane stack rlimit under secureexec

For a secureexec, before memory layout selection has happened, reset the
stack rlimit to something sane to avoid the caller having control over
the resulting layouts.

$ ulimit -s
8192
$ ulimit -s unlimited
$ /bin/sh -c 'ulimit -s'
unlimited
$ sudo /bin/sh -c 'ulimit -s'
8192

Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
fs/exec.c