I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm.
As per my deparment defined requirements, this solution should support SELinux enabled systems to be valid. After a not too thorough research, it was quite obvious that this product did not support SELinux, or needed the system administrator to punch a hole in the SELinux policy because some libraries needed to perform text relocations to be able to operate (not to mention the correctness -or lack thereof- of the commands suggested in their knowledge base).
It is not new that SELinux is proven to expose bugs, but my concern here was to be able to explain to Management to what extent denying text relocations is a major security feature.
Management counteract my reasoning claiming no CVEs are published for this specific product related to its need to perform text relocations.
Is the need to perform text relocations exploitable enough as to represent a CVE elegible vulnerability?