[PATCH v3 3/3] selinux: require EXECMEM for forced ptrace poke

2016-11-02 Thread Jann Horn
This restricts forced writes to private R+X mappings using the EXECMEM permission. To avoid a breaking change, a new policy capability needs to be enabled before the new restrictions take effect. Unlike most other SELinux hooks, this one takes the subject credentials as an argument instead of look

Re: [PATCH v3 3/3] selinux: require EXECMEM for forced ptrace poke

2016-11-03 Thread Stephen Smalley
On 11/02/2016 11:04 PM, Jann Horn wrote: > This restricts forced writes to private R+X mappings using the EXECMEM > permission. To avoid a breaking change, a new policy capability needs to > be enabled before the new restrictions take effect. > > Unlike most other SELinux hooks, this one takes the