Skip to content

Allow spc_t execstack and execmem (bsc#1268490) #472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ca-hu wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −0
Open

Allow spc_t execstack and execmem (bsc#1268490) #472

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions container.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -805,6 +805,7 @@ tunable_policy(`container_connect_any',`
# spc local policy
#
allow spc_t { container_file_t container_var_lib_t container_ro_file_t container_runtime_tmpfs_t}:file entrypoint;
allow spc_t self:process { execstack execmem };

@gemini-code-assist gemini-code-assist Bot Jun 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Allowing execstack (executable stack) poses a significant security risk as it makes memory corruption vulnerabilities (like buffer overflows) much easier to exploit. While execmem is commonly required by runtimes like Java for Just-In-Time (JIT) compilation, execstack is rarely needed by modern applications. To adhere to the principle of least privilege, consider allowing only execmem unless there is a verified requirement for execstack in spc_t containers.

allow spc_t self:process { execmem };

@ca-hu ca-hu Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the AI did not read my commit message.

@rhatdan rhatdan Jun 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we do this as a boolean. I would allow execmem by default and have a container_can_execstack boolean. Then users can just toggle the boolean.

role system_r types spc_t;
dontaudit spc_t self:memprotect mmap_zero;

Expand Down