I am working in CentOS 5, I was wondering why exec-shield isn't on by default? I found a bunch of articles on how to enable and disable it as well - but nothing answering why anyone would want it off. Any cons to turning it on?
Exec-shield can break some programs, depending on how they were written. Eg, look at this reference from a Red Hat mailing list:
I'm guessing that the CentOS maintainers are making the judgment that it is better to ship an OS that runs all programs and is less secure, rather than having users try to diagnose failures in old programs.