Re: [gentoo-hardened] 'paxctl -m bin' everything that complains?

[Grant]

>>> Check out 'ulimit -a' or search for 'ulimit' in bash(1).
>>
>> I read about ulimit and I'm wondering if I need to worry about
>> increasing that coredump size from zero.  Can I just ignore those
>> grsec messages without causing a problem?
>
> Allowing core dumps will enable failed applications to dump a copy of
> their memory to disk; generally this only causes issues if you're
> disk-space sensitive.  It can also be an issue for applications that
> hold sensitive data (like passwords) in-memory.
>
> If you can, yes - just ignore the RLIMIT_CORE ones.  You probably want
> to find out why applications are trying to dump, but the messages are
> a symptom rather than the cause.

It turns out I need to issue 'paxctl -m
/usr/lib64/mozilla-firefox/firefox' to prevent firefox from crashing
when watching a cnn.com video.  Is that a huge security issue?

- Grant