Using test software from pkeys(7) manpage, modified to use PROT_WRITE |
PROT_EXEC, created systemd unit that tries to use memory protection, and
started it as a systemd unit.
Thus calling:
status = pkey_mprotect(buffer, getpagesize(),
PROT_READ | PROT_WRITE | PROT_EXEC, pkey);
if (status == -1)
errExit("pkey_mprotect");
fprintf(stderr, "about to read buffer again...\n");
$ systemctl cat test.service
# /etc/systemd/system/test.service
[Service]
MemoryDenyWriteExecute=true
ExecStart=/home/ubuntu/a.out
$ dpkg-query -W systemd
systemd 234-2ubuntu12.1
>From journal:
a.out[6763]: buffer contains: 69
a.out[6763]: about to read buffer again...
Is bad, since it is expected that MemoryDenyWriteExecute shall not allow
the pkey_mprotect call, and one should not see the "about to read buffer
again..." message.
Upgrading to:
$ dpkg-query -W systemd
systemd 234-2ubuntu12.3
Starting test.unit again, and journal now has:
a.out[17978]: buffer contains: 69
a.out[17978]: pkey_mprotect: Operation not permitted
systemd[1]: test.service: Main process exited, code=exited, status=1/FAILURE
Which is awesome =)
** Tags removed: verification-needed verification-needed-artful
** Tags added: verification-done verification-done-artful
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1725348
Title:
Systemd - Bypassing MemoryDenyWriteExecution policy
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725348/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
