executable_stack limits?

[Richard Pereira_1]

I just went through a small audit and noted that executable_stack is not set to hp's recommendation, any harm in doing so? do i limit the application in any negative way?

Thanks in advance,
Richard

[Peter Godron · Accepted solution]

Richard,
I am right to assume you are running higher than 11.00?
executable_stack was introduced 11i.
Neither ITRC nor metalink report any problems caused by executable_stack settings.

[Don Morris_1]

If it is set outside of the range of 0-2 the kernel should ignore the erroneous setting and use the default (1 on 11.11, 0 on later releases).

If you have it set to:

0 - This is good for security. Any application attempting to execute code off the program stack is terminated.

1 - This is for backwards compatibility, least security. Execution from the stack is allowed.

2 - This is a good 'trial' mode to see if you can go to "0" without disrupting your applications. It will log in the message buffer any attempts to execute from the stack by processes, allowing said executions. So if you're set to 2 -- and you don't see any such messages in the log, you should go to 0 for security. If you do see them - you should work with the authors of the applications to get them fixed if possible.

[Richard Pereira_1]

sorry, Im running 11.i

as a added fyi, these are brand new boxes running peoplesoft, oracle and the latest java products, any hangups there?

[Steve Steel]

Hi


explained in

http://www.docs.hp.com/en/B2355-60105/executable_stack.5.html

The man page


Steve Steel

[Richard Pereira_1]

Thanks gentlement.

[Richard Pereira_1]

.