[MPlayer-dev-eng] Mplayer: PT_GNU_STACK RWE

[Ivan Gyurdiev]

>Better just apply the attached patch. Binary codecs that do not run with
>noexecstack also won't run on WinXPSP2 with "Data Execution Protection"
>activated, so if the codec is still maintained there should be a codec
>that works with it.

Excellent. The patch results in binaries that are marked PT_GNU_STACK
RW. Is this patch for me alone, or are you going to merge it in 
the mplayer source?

>But IMHO SELinux is for people that care about security and then binary
>codec support definitly should be disabled (not to say you better should
>use no media player at all *g* ) - so a separate package
>actually seems a much better idea to me.

Well that's a separate issue that I don't want to go into right now - 
whether or not there should be a media player that works on strict
policy, and does not allow binary codecs. 

--
However,

I dislike how everyone always draws a line and colors everything on one
side as "Secure" and everything on the other as "Non Secure". 
It's my opinion that inability to compromise security requirements to
user requirements is bad for security. Thats why nobody runs SElinux
in strict mode, and it doesn't get any testing. People figure out that
what they want to do doesn't work, and turn the whole thing off. 

My personal computer is not a paranoid setup, and I won't trade
functionality for security. At the same time I think that there's value
in adding strict policy on my machine, even if some apps are considered
"insecure". I don't care if mplayer can run binary codecs or not - I
still appreciate it, when strict policy prevents, or makes more
difficult other intrusions. 

Remember that SElinux is implemented by default in targeted mode on
Fedora Core 3. That's a general purpose operating system. Someday it
might even run in strict mode, at which point you have to deal
with those issues. 

The security policy's need to keep things secure should not 
be incompatible with the user's requirements. I should be able to do
what I want with my SElinux system, with minimal ease. That's why
there's booleans, and you can change those to fit your requirements. The
default setup is always the one that makes sense in a "secure
environment".

Anyway that's just my opinion. 
I'm not employed by RedHat, or the NSA,
so it's not worth anything.

-- 
Ivan Gyurdiev <ivg2 at cornell.edu>
Cornell University