>
> Adam Wiggins writes:
>
> > Is is possible to make a kernel patch or something else to keep an
> > eye out for these byte codes? Without some sort of protection this
> > could case some major problems with pentium based linux boxes.
>
> Sure, at a cost.
>
> 1. Add the patch to stop execution on the stack.
> 2. Check every page that becomes executable.
> 3. Check every page that is swapped in as executable.
> 4. Enforce read-only for executable pages.
> 5. Watch out for the debugger.
>
> When a process tries to make a page writeable _and_ executable,
> remove one permission or the other. (the one that does not
> break too many programs)
AFAIK, you don't have that option on the x86 architecture. The pages are
read-only _or_ readable, writeable and executable. Unfortunately, that's
the available granularity.
astor
-- Alexander Kjeldaas, Guardian Networks AS, Trondheim, Norway http://www.guardian.no/