noexec mount-option with selinux?

[Marten Lehmann]

> A) Build a custom SELinux policy, and maintain it as reference policy is
> updated, and debug all the issues yourself.

I just need a hint on how to create a system-wide policy, not just an
application level policy. Where can I find details on this?

> B) Bite the bullet, and repartition with a separate /tmp (which is a good
> idea even without SELinux, as it kills off a whole class of attacks using
> hardlinks from /tmp to places on the root partition).

It is not a technical problem to create a separate partition. But as I wrote
in my first email I just cannot do it, because there is no way in linux to
have system-wide quotas. Quotas are always only valid for one single
partition. If I have quotas on the root partition (which includes /home) but
/tmp is on a separate partition, then the quotas of / (and thus /home) don't
apply for /tmp. That is the only reason why I have a look at selinux.

If you have any other idea to have the same quotas for /home and /tmp while
/tmp doesn't allow to execute files but /home does, then please tell me.

Regards
Marten