Hi Stephen,

Stephen Smalley wrote:
> On Tue, 2004-11-23 at 21:04, Daniel J Walsh wrote:
>

>>Trying to run java from within firefox is a disaster, Mozilla crashes.
>>
>>allow user_mozilla_t ld_so_cache_t:file execute;
>>allow user_mozilla_t lib_t:file execute; (Jar files)
>>allow user_mozilla_t user_tmp_t:file execute;
>>allow user_t ld_so_cache_t:file execute;
>>allow user_t locale_t:file execute;

I made a patch to the kernel that reverts to the old behaviour. no more execs on random files. I find that changing the policy to allow those execs is not a valid solution.

would it be feasible to send upstream a patch that would remove the 'exec on read' behaviour if the kernel has selinux capabilities?

bye,
peter

-- 
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux


--- linux-2.6.9.orig/mm/mmap.c	2004-11-11 20:18:36.436249280 +0200
+++ linux-2.6.9/mm/mmap.c	2004-11-11 20:20:47.863269336 +0200
@@ -790,10 +790,12 @@
 	 * (the exception is when the underlying filesystem is noexec
 	 *  mounted, in which case we dont add PROT_EXEC.)
 	 */
+	/*
+ 	// this breaks havoc on a SELinux system
 	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
 		if (!(file && (file->f_vfsmnt->mnt_flags & MNT_NOEXEC)))
 			prot |= PROT_EXEC;
-
+	*/
 	if (!len)
 		return addr;
 




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: OpenPGP digital signature