grsecurity forums

We're storing our PAX stuff in XATTR, and it's generally working out alright. Except when package updates happen: old binary is deleted, new binary is created, service is restarted. Which may or may not work, since the extended attributes no longer exist for that file. We've looked at using incron to automatically re-set the flags, but if the file is deleted, the inotify handle is lost, so this doesn't work very well.

How do folks keep a persistent set of PAX flags? Is there some trick to automatically re-create the flags when the file is updated/deleted/created?

Is paxctld not working properly?

-Brad

.... wow. Not sure how I missed that. It looks pretty much exactly like what I want.