Bug 2055822

+++ This bug was initially created as a clone of Bug #2053815 +++

Description of problem:

I discovered selinuxuser_execstack=1 (via system-config-selinux)

I also discovered the description of that setting:
'allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla'

So, thought that sounded nasty and I turned it off:
# getsebool selinuxuser_execstack
selinuxuser_execstack --> off

Now,
The Cockpit SELinux policy page reports under 'System modifications':
'Disallow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla'

So, that suggests that the default for the system is selinuxuser_execstack=1 and that seems wrong, given the warnings above...

But:
# semanage boolean -l | grep selinuxuser_execstack
selinuxuser_execstack          (off  ,  off)  Allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

So, I'm a bit confused - perhaps this is a bug in Cockpit's reporting?


Version-Release number of selected component (if applicable):
libselinux-2.9-5
selinux-policy.noarch-3.14.3-80
cockpit-251.3-1

How reproducible:
Apparently always

Steps to Reproduce:
1. Install selinux & cockpit
2. Check on selinuxuser_execstack
3.

Actual results:
Confusing

Expected results:
Not confusing

Additional info:

--- Additional comment from Milos Malik on 2022-02-14 09:18:53 CET ---

Default value of the selinuxuser_execmod boolean is also an issue.