Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: execmem and targeted policy: msg#00074
|
Subject: |
Re: execmem and targeted policy |
On Thu, 2005-02-10 at 13:17, Colin Walters wrote:
> I noticed that as of a recent rawhide update that Eclipse stopped
> working:
>
> audit(1108057938.336:0): avc: denied { execmem } for pid=14065
> comm=eclipse scontext=user_u:system_r:unconfined_t
> tcontext=user_u:system_r:unconfined_t tclass=process
>
> Chatting with Dan, this is apparently because the execmem permission was
> dropped from unconfined_domain recently.
>
> We can't do this in targeted policy because it would require us to know
> about (and specially label) all such programs.
It is controlled by a boolean. So simply enable the allow_execmem and
allow_execmod booleans by default in the targeted policy (via the
booleans config file). Or if you absolutely must unconditionally allow
it in targeted policy, put the allow rules in the targeted unconfined.te
file so that you don't affect the strict policy. But note that the
reason for subjecting these permissions to booleans even in the targeted
policy was that we were asked to do so by Ulrich (see the earlier
discussion on rhselinux-list).
--
Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency
|
| |
