The following program highlights the problem:
#include <sys/mman.h> #include <sys/ioctl.h> #include <fcntl.h> #include <linux/ashmem.h> #include <unistd.h> #include <sys/syscall.h>
void set_personality(unsigned int p) { syscall(__NR_personality, p); }
int main() { int fd = open("/dev/ashmem", O_RDWR); set_personality(0); ioctl(fd, ASHMEM_SET_SIZE, 4096); ioctl(fd, ASHMEM_SET_PROT_MASK, PROT_READ); set_personality(0x0400000 /* READ_IMPLIES_EXEC */); if (mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0) == MAP_FAILED) return 1; return 0; }
The following program highlights the problem:
#include <sys/mman.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <linux/ashmem.h>
#include <unistd.h>
#include <sys/syscall.h>
void set_personality (unsigned int p) { __NR_personalit y, p);
syscall(
}
int main() { ty(0); SET_PROT_ MASK, PROT_READ); ty(0x0400000 /* READ_IMPLIES_EXEC */);
int fd = open("/dev/ashmem", O_RDWR);
set_personali
ioctl(fd, ASHMEM_SET_SIZE, 4096);
ioctl(fd, ASHMEM_
set_personali
if (mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0) == MAP_FAILED)
return 1;
return 0;
}