[lkml]   [2019]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC PATCH 7/9] x86/sgx: Enforce noexec filesystem restriction for enclaves
On Tue, Jun 4, 2019 at 9:26 AM Jarkko Sakkinen
<> wrote:
> On Fri, May 31, 2019 at 04:31:57PM -0700, Sean Christopherson wrote:
> > Do not allow an enclave page to be mapped with PROT_EXEC if the source
> > page is backed by a file on a noexec file system.
> >
> > Signed-off-by: Sean Christopherson <>
> Why don't you just check in sgx_encl_add_page() that whether the path
> comes from noexec and deny if SECINFO contains X?

SECINFO seems almost entirely useless for this kind of thing because
of SGX2. I'm thinking that SECINFO should be completely ignored for
anything other than its required architectural purpose.

 \ /
  Last update: 2019-06-04 22:33    [W:0.101 / U:0.868 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site