"NAX" Linux Security Being Worked On For Helping Fend Off Fileless Malware Attacks

Written by Michael Larabel in Linux Security on 21 August 2021 at 06:04 AM EDT. 7 Comments
Due to the growing threat posed by file-less malware attacks where malware code is executed from anonymous executable memory pages that aren't backed by data on the file-system, the "NAX" Linux security module has been seeing work recently for helping to protect against such scenarios.

The NAX Linux Security Module is around "no anonymous execution" of pages. The kernel security module prevents the creation of anonymous executable pages for processes by intercepting of mmap/mprotect system calls and handling them appropriately.

The NAX LSM has seen five rounds of review recently to help address the growing threat of file-less malware attacks. There still is more work to go on this security module and also some fundamental challenges like potential complications for existing JIT compilers on systems being broken by this module.

More details on the work being done around the NAX LSM can be found via the kernel mailing list.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week