From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Tue, 30 May 2017 20:43:48 +0000 (-0400)
Subject: man: update MemoryDenyWriteExecute description for executable stacks
X-Git-Tag: v234~152^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=03c3c520402db803cffd5abc7ea0c55fba95fbb3;p=thirdparty%2Fsystemd.git

man: update MemoryDenyWriteExecute description for executable stacks

Without going into details, mention that libraries are also covered by the
filters, and that executable stacks are a no no.

Closes #5970.
---

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 2e9cfa89ddf..54dad930b10 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1656,8 +1656,8 @@
         <citerefentry><refentrytitle>mprotect</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls with
         <constant>PROT_EXEC</constant> set and
         <citerefentry><refentrytitle>shmat</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls with
-        <constant>SHM_EXEC</constant> set. Note that this option is incompatible with programs that generate program
-        code dynamically at runtime, such as JIT execution engines, or programs compiled making use of the code
+        <constant>SHM_EXEC</constant> set. Note that this option is incompatible with programs and libraries that
+        generate program code dynamically at runtime, including JIT execution engines, executable stacks, and code
         "trampoline" feature of various C compilers. This option improves service security, as it makes harder for
         software exploits to change running code dynamically. Note that this feature is fully available on x86-64, and
         partially on x86. Specifically, the <function>shmat()</function> protection is not available on x86. Note that