On 7/28/20 12:05 PM, James Morris wrote: > On Tue, 28 Jul 2020, Casey Schaufler wrote: > >> You could make a separate LSM to do these checks instead of limiting >> it to SELinux. Your use case, your call, of course. > It's not limited to SELinux. This is hooked via the LSM API and > implementable by any LSM (similar to execmem, execstack etc.) Yes. I have an implementation that I am testing right now that defines the hook for exectramp and implements it for SELinux. That is why I mentioned SELinux. Madhavan
