[OpenBSD] staticperl dying unexpectedly with Coro/jit...

[Petr Pisar]

On Sat, Oct 29, 2016 at 09:16:52PM +0200, Marc Lehmann wrote:
> On Thu, Oct 27, 2016 at 03:59:41PM +0200, nomad at null.net wrote:
> Wow, so apparently your kernel abort's on the mmap call.
> 
I missed what operating system is used in this case, but I spotted similar
behavior on SELinux-enabled operating system with PCRE that also implements
JIT. SELinux policy authors believe having a writable and executable memory
page is not good for security and disallow it.

A way how to implement security-friendly JIT is documented on
<https://www.akkadia.org/drepper/selinux-mem.html>. The trick is have one
writable only virtual page and one executable only virtual page, both mapped
onto the same physical page. This can be achieved by mmaping a temporary (or
anonymous) file twice and then restricing permissions by mprotect().

Probably the idea is a successful exploit would have to obtain relative
distance between the two mappings and that's impossible without prior
abitrary-code-execution bug and improbable with randomized address space.

-- Petr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 213 bytes
Desc: not available
URL: <http://lists.schmorp.de/pipermail/anyevent/attachments/20161031/96f5d602/attachment.sig>