a759b22c2
Denys Vlasenko
2017-08-06
Subject
nameif: make it NOEXEC
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
NOFORK_NOEXEC.lst+2 -2
| @@ -237,10 +237,10 @@ modprobe - noexec | |
| more - interactive, longterm | |
| mount - suid | |
| mountpoint - noexec. leaks: option -n "print dev name": find_block_device -> readdir+xstrdup | |
| - | mpstat - noexec candidate (it's a measuring tool, putting less load by itself is good), complex |
| + | mpstat - longterm: "mpstat 1" runs indefinitely |
| mt - rare | |
| mv - noexec candidate, runner | |
| - | nameif - leaks: config_open2+ioctl_or_perror_and_die |
| + | nameif - noexec. openlog(), leaks: config_open2+ioctl_or_perror_and_die |
| nbd-client | |
| nc - runner | |
| netstat - runner with -c | |
networking/nameif.c+1 -1
| @@ -40,7 +40,7 @@ | |
| //config: new_interface_name mac=00:80:C8:38:91:B5 | |
| //config: new_interface_name 00:80:C8:38:91:B5 | |
| - | //applet:IF_NAMEIF(APPLET(nameif, BB_DIR_SBIN, BB_SUID_DROP)) |
| + | //applet:IF_NAMEIF(APPLET_NOEXEC(nameif, nameif, BB_DIR_SBIN, BB_SUID_DROP, nameif)) |
| //kbuild:lib-$(CONFIG_NAMEIF) += nameif.o | |
procps/mpstat.c+1 -0
| @@ -8,6 +8,7 @@ | |
| */ | |
| //applet:IF_MPSTAT(APPLET(mpstat, BB_DIR_BIN, BB_SUID_DROP)) | |
| + | /* shouldn't be noexec: "mpstat INTERVAL" runs indefinitely */ |
| //kbuild:lib-$(CONFIG_MPSTAT) += mpstat.o | |