> If you employ GRsecurity's RBAC, you can use PAX flags, like > "PAX_MPROTECT" on a given subject (binary). Take a look at on the example > policy file.
Do you guys think RBAC or /etc/portage/bashrc is a better choice for this? Maybe RBAC is overkill if this is all I'll be using it for? - Grant >>>>> and create executable shell script in that dir: >>>>> mozilla-firefox-bin.postinst >>>>> ---cut--- >>>>> #!/bin/bash >>>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on >>>>> flash!" >>>>> chpax -m /opt/firefox/firefox-bin >>>>> ---cut--- >>>>> >>>> >>>> Of course, if you compile firefox instead of using firefox-bin, then >>>> file >>>> should be named mozilla-firefox.postinst and you should use there >>>> paxctl >>>> instead of chpax. >>>> >>> A simple cron job or slightly-less-simple RBAC policy can do the trick. >>> There's no need to mess with portage, imho. >> >> Thanks for the suggestions everyone. I think this type of persistence >> should be built into portage. Maybe /etc/portage/package.nomprotect. >> Do you agree? Should I file a bug? >> >> - Grant
