Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working in CentOS 5, I was wondering why exec-shield isn't on by default? I found a bunch of articles on how to enable and disable it as well - but nothing answering why anyone would want it off. Any cons to turning it on?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Exec-shield can break some programs, depending on how they were written. Eg, look at this reference from a Red Hat mailing list:

2 enables every exec-shield unconditionally (modulo exec-shield-randomize) regardless of the type of executable loaded. This WILL break programs, and is generally discouraged, but you've got enough rope to hang yourself and break your Loki games. :-)

I'm guessing that the CentOS maintainers are making the judgment that it is better to ship an OS that runs all programs and is less secure, rather than having users try to diagnose failures in old programs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.