Re: Latest Ref Policy Diffs

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Fri, 2005-12-09 at 09:40 -0500, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Thu, 2005-12-08 at 16:14 -0500, Daniel J Walsh wrote:
> >   
> >> Major change in targeted policy is about to hit.  Basically we are going 
> >> to turn off allow_execmod, allow_execmem, and allow_execstack by default 
> >> for unconfined_t programs.
> >>
> > I just have a question about this hunk:
> >   
> >> @@ -79,6 +75,8 @@
> >>  
> >>  ifdef(`targeted_policy',`
> >>         unconfined_domain_template(xdm_t)
> >> +       allow xdm_t self:process execmem;
> >> +        unconfined_domtrans(xdm_t)
> >>  ',`
> >>         allow xdm_t xdm_lock_t:file create_file_perms;
> >>         files_create_lock(xdm_t,xdm_lock_t)
> >>     
> >
> > Shouldn't the execmem be outside of the ifdef, since if it needs this,
> > it will need it regardless of the policy type?
> >
> I think in a strict policy machine, the xserver will need this not xdm?
> 
> Since we are not using xserver policy, The xserver is running as xdm.

Ok, that makes sense.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.