On Thu, 2005-12-08 at 16:14 -0500, Daniel J Walsh wrote:
> Major change in targeted policy is about to hit. Basically we are going
> to turn off allow_execmod, allow_execmem, and allow_execstack by default
> for unconfined_t programs.

I just have a question about this hunk:

> @@ -79,6 +75,8 @@
>
> ifdef(`targeted_policy',`
> unconfined_domain_template(xdm_t)
> + allow xdm_t self:process execmem;
> + unconfined_domtrans(xdm_t)
> ',`
> allow xdm_t xdm_lock_t:file create_file_perms;
> files_create_lock(xdm_t,xdm_lock_t)

Shouldn't the execmem be outside of the ifdef, since if it needs this, it will need it regardless of the policy type?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.