Print this page
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 140,153 **** <!ELEMENT admin EMPTY> <!ATTLIST admin user CDATA #REQUIRED auths CDATA #REQUIRED> <!ELEMENT zone (filesystem | inherited-pkg-dir | network | device | deleted-device | rctl | attr | dataset | package | patch | dev-perm | tmp_pool | pset | ! mcap | admin)*> <!ATTLIST zone name CDATA #REQUIRED zonepath CDATA #REQUIRED autoboot (true | false) #REQUIRED ip-type CDATA "" --- 140,159 ---- <!ELEMENT admin EMPTY> <!ATTLIST admin user CDATA #REQUIRED auths CDATA #REQUIRED> + <!ELEMENT security-flags EMPTY> + + <!ATTLIST security-flags default CDATA "" + lower CDATA "" + upper CDATA ""> + <!ELEMENT zone (filesystem | inherited-pkg-dir | network | device | deleted-device | rctl | attr | dataset | package | patch | dev-perm | tmp_pool | pset | ! mcap | admin | security-flags)*> <!ATTLIST zone name CDATA #REQUIRED zonepath CDATA #REQUIRED autoboot (true | false) #REQUIRED ip-type CDATA ""