Re: Adding two new booleans to httpd to tighten it's security.

VMWare has problems with execmem as previously reported:
type=AVC msg=audit(1134338328.000:56): avc: denied { execmem } for
pid=5215 comm="ld-linux.so.2"
scontext=root:system_r:unconfined_t:s0-s0:c0.c255
tcontext=root:system_r:unconfined_t:s0-s0:c0.c255 tclass=process
type=SYSCALL msg=audit(1134338328.000:56): arch=40000003 syscall=125
success=no exit=-13 a0=bfc78000 a1=1000 a2=1000007 a3=98b6e0 items=0
pid=5215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 comm="ld-linux.so.2" exe="/lib/ld-2.3.90.so"

and
time->Sun Dec 11 13:05:51 2005
type=AVC_PATH msg=audit(1134335151.660:39):
path="/usr/lib/vmware/lib/libgdk-x11-2.0.so.0/libgdk-x11-2.0.so.0"
type=SYSCALL msg=audit(1134335151.660:39): arch=40000003 syscall=125 per=400000
success=no exit=-13 a0=b7c99000 a1=7b000 a2=5 a3=bfc5a1e0 items=0
pid=4418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 comm="vmware" exe="/usr/lib/vmware/bin/vmware"
type=AVC msg=audit(1134335151.660:39): avc:  denied  { execmod } for
pid=4418 comm="vmware" name="libgdk-x11-2.0.so.0" dev=dm-0 ino=343461
scontext=root:system_r:unconfined_t:s0-s0:c0.c255
tcontext=system_u:object_r:lib_t:s0 tclass=file


Reply from VMware on my complaint about execmem issues:


As your system refuses to execute even /lib/ld-2.3.90.so (if I
understand it correctly), you seems to have some problem...

None of VMware parts (at least I believe) require executable stack or
heap. Applications which need it explicitly call mmap with PROT_EXEC.
Another question is whether libraries we ship are correctly tagged to
signal this - but it should not be problem as you can install all
libraries VMware needs from your distribution, VMware just ships
libraries it was linked with as it is simpler for us to ship you
libgdk-whatever than (finding and) explaining that you must to install
some-strange-package-with-no-gdk-in-filename to get VMware to work. On
"correct" system with all libraries you should be able to run vmware
directly by /usr/lib/vmware/bin/vmware. Apparently your system is
missing at least openssl097...
--------------------------------------------


My understanding from this thread on how execmem works is that calling
mmap with PROT_EXEC can (will?) still trigger execmem.  Right?

Here is the link to the discussion thread: Please hop on to help/clarify!
http://www.vmware.com/community/thread.jspa?messageID=320149&#320149

thanks,
   tom
--
Tom London