Re: How to signal kernel that shared library is not in use by any process anymore ?

2019-01-05 Thread Lev Olshvang
Shachar , you are 100%/ right ! Since I knew that mmap needs file descriptor I assumed ( and did not checked man page)  that munmap need file descriptor. Great !!Thanks, Thanks,  Thanks!  04.01.2019, 22:30, "Shachar Shemesh" : On 27/12/2018 15:34, Lev Olshvang wrote:Can you elaborate why I can not

Re: How to signal kernel that shared library is not in use by any process anymore ?

2019-01-05 Thread Shachar Shemesh
On 05/01/2019 10:36, Lev Olshvang wrote: Since I knew that mmap needs file descriptor I assumed ( and did not checked man page)  that munmap need file descriptor. That's not true either, actually. Mmap absolutely does not need a file

How to forbid user space and kernel executable pages from becoming writable?

2019-01-05 Thread Lev Olshvang
I am researching this issue and I am confused with the finding Some articles, ex https://shanetully.com/2013/12/writing-a-self-mutating-x86_64-c-program/ state that mprotect() can change protection of executable section. As I understanf pte entry has page protection bits set to RO so mprotect

Re: How to forbid user space and kernel executable pages from becoming writable?

2019-01-05 Thread Shachar Shemesh
All of the below seemed really strange to me, because I researched it when I wrote fakeroot-ng. To make sure, I wrote the following program: #include #include #include #include #include #include int main() {

is it possible to mount /proc as read-only on embedded system

2019-01-05 Thread Lev Olshvang
Hello all, I am trying to harden the embedded system. Is it possible and safe to mount /proc file system in a read-only mode and how to do this? I have embedded system with systemd where /proc is mounted rw. I suspect that systemd mounts it when it bebins to bootsrtap user space. On my very

Re: How to forbid user space and kernel executable pages from becoming writable?

2019-01-05 Thread Shachar Shemesh
On 05/01/2019 22:22, Shachar Shemesh wrote: Since the above completely describes what the loader does to an executable file, I don't see how mprotect can be used there either. So, I decided to check my assumptions.