From 74169bbfad4d46b5a71fefe99902a8e236c9d9ba Mon Sep 17 00:00:00 2001 From: Yann Droneaud Date: Mon, 10 Mar 2014 18:13:10 +0100 Subject: [PATCH] README.md: add more indent on shell code to disable mmap min addr (again) Signed-off-by: Yann Droneaud --- README.md | 35 ++++++++++++++--------------------- 1 file changed, 14 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index 783f480..0ee53dd 100644 --- a/README.md +++ b/README.md @@ -146,40 +146,33 @@ and kernel: it's not possible by default, thanks to features added to Linux kernel: - `vm.mmap_min_addr` is the minimal address the kernel will allow you to map + - get: + - with sysctl - - get: + $ sysctl vm.mmap_min_addr - - with sysctl + - with cat + $ cat /proc/sys/vm/mmap_min_addr - $ sysctl vm.mmap_min_addr + - set: + - with sysctl - - with cat + # sysctl -w vm.mmap_min_addr=0 - $ cat /proc/sys/vm/mmap_min_addr + - with `echo` - - set: - - - with sysctl - - # sysctl -w vm.mmap_min_addr=0 - - - with `echo` - - - # echo 0 > /proc/sys/vm/mmap_min_addr + # echo 0 > /proc/sys/vm/mmap_min_addr - SELinux enforce another limit on context: + - get: - - get: - - - $ getsebool mmap_low_allowed + $ getsebool mmap_low_allowed - - set: + - set: + # setsebool mmap_low_allowed=on - # setsebool mmap_low_allowed=on - [PaX][PAX] UDREF (and KERNEXEC) (within [grsecurity][GRSECURITY] kernel) will disallow direct access to userspace from kernel mode, so the kernel won't be able to access page 0 -- 2.1.4