Files
systemd/test/units
Christian Brauner 9b62fd169e Extend W^X memory protection mechanism for RestrictFileSystemAccess (#43511)
Currently `RestrictFileSystemAccess` isn't trying hard enough to enforce
W^X and thus there are still places where an executable and writable
mapping can be created:

* `/proc/<pid>/mem` `FOLL_FORCE` writes
* `PTRACE_POKE{TEXT,DATA}` `FOLL_FORCE` writes
* `MAP_PRIVATE | MAP_EXECUTABLE` memory mappings

Let's block all of these mechanisms. Do note that
`RestrictFileSystemAccess` is still in very active development and also
cannot meaningfully be used on general purpose distros and systems.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-01 07:12:13 +02:00
..
2025-12-07 09:09:03 +09:00
2025-02-18 13:49:24 +01:00