[gentoo-hardened] Process permission noatsecure

[Bill McCarty]

Hi all,

Can someone tell me what the noatsecure process permission enables? It 
appears to concern the inheritance of a sanitized environment, but I can't 
make out the details. More generally, is there a document that describes 
the various access vector components? Most components are based on system 
calls and are easily understood. But, a few are more or less mysterious to 
me, including:

    setexec:     unknown
    setfscreate: permission to create filesystem?
    noatsecure:  unknown
    siginh:      inheritance of signal handler?
    rlimitinh:   inheritance of resource limit?

I find a few programs that seem to need the noatsecure permission. Because 
the sample policy includes several dontaudits related to this permission, 
I'm having some small difficulties developing appropriate policies for such 
programs.

Thanks!

---------------------------------------------------
Bill McCarty

--
gentoo-hardened@g.o mailing list