Don't agree. If you employ GRsecurity's RBAC, you can use PAX flags, like "PAX_MPROTECT" on a given subject (binary). Take a look at on the example policy file.
Regards: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057, 06-30-5962-962 Attila Toth MD, Radiologist, +36-20-825-8057, +36-30-5962-962 On Pén, Április 10, 2009 18:29, Grant wrote: >>>> and create executable shell script in that dir: >>>> mozilla-firefox-bin.postinst >>>> ---cut--- >>>> #!/bin/bash >>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on >>>> flash!" >>>> chpax -m /opt/firefox/firefox-bin >>>> ---cut--- >>>> >>> >>> Of course, if you compile firefox instead of using firefox-bin, then >>> file >>> should be named mozilla-firefox.postinst and you should use there >>> paxctl >>> instead of chpax. >>> >> A simple cron job or slightly-less-simple RBAC policy can do the trick. >> There's no need to mess with portage, imho. > > Thanks for the suggestions everyone. I think this type of persistence > should be built into portage. Maybe /etc/portage/package.nomprotect. > Do you agree? Should I file a bug? > > - Grant >
