document allow_execmem

[jmau111]

Hi,

I'm testing rules on a Debian.

Why do we have to allow execmem manually in some cases where apps need it (seems to happen frequently)?

avc:  denied  { execmem } for  pid=nnnn comm="...

I guess if it's not enabled by default, then it's probably not particularly safe or there are some issues related. Is that a good practice to allow it generally like sudo setsebool -P allow_execmem 1?

If it's not a good practice, can you indicate the right one?

[jmau111]

hi, anyone?

[williamcroberts]

It is documented:

• https://github.com/SELinuxProject/selinux-notebook/releases

execmem: "Make executable an anonymous mapping or private file mapping that is writable."

It's bad because it allows a write/execute code path. This really only useful for things that JIT IIRC. Sometimes it triggers because of bad file permissions, ie they open a file writeable but never actually write and the fix is changing the code not the policy.

[jmau111]

@williamcroberts thank you for the hint. How would you authorize processes to access memory safely?