Re: how to turn off PIE on Fedora?

[Per Bothner <per at bothner dot com>]

Brad Roberts wrote:

> This is largely offtopic for this list, but wouldn't having it user
> disableable largely defeat the safety that exec-shield is attempting to
> provide?

I don't think so, but I might be missing something.  Exec-shield doesn't 
limit the ability of a program or a user to do anything.  What it does 
is make it much harder to *trick* a program that *has* certain 
priviliges to do something by exploiting a bug.  So any program that
does something on behalf of another user (such as a set-uid program or a 
server) benefits from exec-shield.  "User program" don't, as far as I 
can see, but I'm not a security expert.  So you might want to prohibit 
calls like setuid in a process started without exec-shield.
--
	--Per Bothner
per@bothner.com   http://per.bothner.com/