Disable the selinuxuser_execstack SELinux Boolean
An XCCDF Rule
Description
By default, the SELinux boolean selinuxuser_execstack is enabled.
This setting should be disabled as unconfined executables should not be able
to make their stack executable.
To disable the selinuxuser_execstack SELinux boolean, run the following command:
$ sudo setsebool -P selinuxuser_execstack off
Rationale
Disabling code execution from the stack blocks buffer overflow attacks.
- ID
- xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execstack
- Severity
- Medium
- References
- Updated