Re: Execmem boolean

[Stephen Smalley <sds@xxxxxxxxxxxxx>]

On Wed, 2005-06-29 at 14:54 -0400, Ivan Gyurdiev wrote:
> Please don't break strict policy :(
> 
> I still have some hope left to be able to 
> run it on my home machine. The level of "strictness"
> should be configurable.
> 
> We could kill the allow_execmod/allow_execmem booleans,
> allow execmod to texrel, allow exemem for X,
> and then have per app booleans for other things we don't trust
> (like Java applets?). 

You'd also need something to enable/disable execmem for the user
domains, as not everything that wants it runs in its own domain yet.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.