Interesting reading on exec* access checks.

[Daniel J Walsh <dwalsh@redhat.com>]

http://people.redhat.com/drepper/selinux-mem.html

We are planning on turning off allow_execmem, allow_execmod, 
allow_execheap for unconfined_t in targeted policy.  We are working to 
clean up any problems this might cause.  This will add additional 
security features to Userspace, but might cause headaches.

If you have the latest policy installed on Rawhide

selinux-policy-targeted-2.1.0-3 or later you can try it out by running

setsebool -P allow_execmem=0 allow_execmod=0 allow_execheap=0

You might need to relabel /usr/lib and /lib.

Any help would be appreciated.  :^)

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.