• Philip Sanderson's avatar
    lguest: example launcher to use guard pages, drop PROT_EXEC, fix limit logic · 5230ff0c
    Philip Sanderson authored
    PROT_EXEC seems to be completely unnecessary (as the lguest binary
    never executes there), and will allow it to work with SELinux (and
    more importantly, PaX :-) as they can/do forbid writable and
    executable mappings.
    
    Also, map PROT_NONE guard pages at start and end of guest memory for extra
    paranoia.
    
    I changed the length check to addr + size > guest_limit because >= is wrong
    (addr of 0, size of getpagesize() with a guest_limit of getpagesize() would
    false positive).
    Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
    5230ff0c
lguest.c 58.6 KB