Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Dominick Grift <dominick.grift@defensec.nl>
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: sddm issue and patch not for inclusion
References: <YBKffiAQlZZZbCix@xev> <1944791.8TnJqL1ZiL@liv>
        <ypjlmtwti26f.fsf@defensec.nl> <10144859.lm3J6uu7uN@liv>
Date:   Thu, 28 Jan 2021 15:32:16 +0100
In-Reply-To: <10144859.lm3J6uu7uN@liv> (Russell Coker's message of "Fri, 29
        Jan 2021 01:12:26 +1100")
Message-ID: <ypjlim7hi13j.fsf@defensec.nl>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> On Friday, 29 January 2021 1:08:56 AM AEDT Dominick Grift wrote:
>> > That's a design decision.  One could make a convincing argument that it's
>> > a
>> > good decision.
>> 
>> Not sure whether doing text-relocation on a file you created yourself is
>> a good decision. From a security perspective does not seem like very
>> good thing to along, The more because xdm is shared between various
>> desktop managers.
>
> Oh yes, execmod is bad.  I thought your comment was about the use of PAM.

The pam decision is good in my view, i started doing that half a decade
ago.

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift