> It should be dealt with by making the loader simply load /usr/lib/javaexec
> or the like which does the mashing around of parameters and runs the
> users desired java interpreter tool. The existing java module specifies
> too much policy
Peter Anvin's has a good idea: even the path of the policy tool is policy
and ought to be something you can set in a /proc/sys file.
I would only add that we might as well generalize this, providing it as a
module which creates a table of prefix lookups and policy/execution tool
paths in a /proc/sys file so that any number of different executable formats
can be serviced. With this approach, it becomes possible to specify things
like whether suid and sgid will be allowed for a particular format, which
could be important.
I'm suggesting the `one-module-fits-all' approach because, if we do this
one-executable-format-at-a-time, we are going to end up with a lot of little
modules which look almost exactly alike, supporting every executable format
anyone can think of. Might as well do it in one module with some
flexibility and no hard-wired kernel policy.
And, of course, if it's done in a module people who think the whole idea is
insane won't have to compile or load the module.... :)
lilo