Re: [RFC][PATCH] Control ability to have a writable executable mapping

[Stephen Smalley <sds@epoch.ncsc.mil>]

On Tue, 2004-11-09 at 13:40, Stephen Smalley wrote:
> Please note that this patch does NOT provide the functionality of PAX,
> exec-shield, NX support, etc.  It merely provides SELinux policy control
> over the ability to create an executable mapping that can contain data
> not covered by file permission checks.

Sorry, the last statement isn't accurate; this patch only provides
SELinux policy control over the ability to have a mapping that is
simultaneously writable and executable.  One could still create a rw
mapping and then later change its protection to rx.  For anonymous
mappings, the patch could be trivially modified to apply the check for
any PROT_EXEC mapping and thus prevent executable anonymous mappings
entirely except when explicitly allowed; that seems reasonable.  Private
file mappings are more problematic.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.