syd-mdwe1
Run a program under memory-deny-write-execute protections
Usage
syd-mdwe [-hms]
command
[args ...]
Overview
syd-mdwe utility runs a program under Memory-Deny-Write-Execute (MDWE) protections. The protections can be applied using prctl(2) and seccomp(2), These protections are identical to what Syd applies by default.
Options
| -h | Display help. |
| -m | Enable MDWE protections using prctl(2) PR_SET_MDWE (default: both). |
| -s | Enable MDWE protections using seccomp(2) (default: both). |
Examples
Running pax-test once standalone and once under syd-mdwe(1) on a 6.8 kernel we get the following differences:
| PaX Testcase | standalone | mdwe |
| Executable anonymous mapping | Killed | Killed |
| Executable bss | Killed | Killed |
| Executable data | Killed | Killed |
| Executable heap | Killed | Killed |
| Executable stack | Killed | Killed |
| Executable shared library bss | Killed | Killed |
| Executable shared library data | Killed | Killed |
| Executable anonymous mapping (mprotect) | Vulnerable | Killed |
| Executable bss (mprotect) | Vulnerable | Killed |
| Executable data (mprotect) | Vulnerable | Killed |
| Executable heap (mprotect) | Vulnerable | Killed |
| Executable stack (mprotect) | Vulnerable | Killed |
| Executable shared library bss (mprotect) | Vulnerable | Killed |
| Executable shared library data (mprotect): | Vulnerable | Killed |
| Writable text segments | Vulnerable | Killed |
The test was performed with paxtest-0.9.15:
PaXtest - Copyright(c) 2003-2016 by Peter Busser <[email protected]> and Brad Spengler <[email protected]> Released under the GNU Public Licence version 2 or later Mode: 1 Blackhat Kernel: Linux syd 6.8.0-syd-13213-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux
Exit status
On clean exit, syd-mdwe exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails syd-mdwe exits with the errno(3) number.
Caveats
By default, prctl(2) error setting PR_SET_MDWE(2const) is not fatal. Use the -m option to make this error fatal. This utility does not work on MIPS architectures where Linux requires executable stack.