On Tue, 13 Jul 2010, Török Edwin <edwintorok@xxxxxxxxx> wrote: > So if I map a tempfile as RW, write my JITed code to it, then mprotect > to RX will it work without 'execmem'? In this case I think that there are two viable options. One is to prevent execmem for both freshclam_t and clamd_t and have them both interpret the data, a performance cost for a security benefit. The other is to allow them both execmem access for best performance. I have already submitted a patch to the policy list to implement this. -- russell@xxxxxxxxxxxx http://etbe.coker.com.au/ My Main Blog http://doc.coker.com.au/ My Documents Blog -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
