[PATCH] selinux: make default_noexec read-only after init

[PATCH] selinux: make default_noexec read-only after init

[Stephen Smalley]

SELinux checks whether VM_EXEC is set in the VM_DATA_DEFAULT_FLAGS
during initialization and saves the result in default_noexec for use
in its mmap and mprotect hook function implementations to decide
whether to apply EXECMEM, EXECHEAP, EXECSTACK, and EXECMOD checks.
Mark default_noexec as ro_after_init to prevent later clearing it
and thereby disabling these checks.  It is only set legitimately from
init code.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 security/selinux/hooks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6777e04fd942..7834f0a4c2a8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3650,7 +3650,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
 	return error;
 }
 
-static int default_noexec;
+static int default_noexec __ro_after_init;
 
 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
 {
-- 
2.24.1

Re: [PATCH] selinux: make default_noexec read-only after init

[Paul Moore]

On Wed, Jan 8, 2020 at 12:23 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> SELinux checks whether VM_EXEC is set in the VM_DATA_DEFAULT_FLAGS
> during initialization and saves the result in default_noexec for use
> in its mmap and mprotect hook function implementations to decide
> whether to apply EXECMEM, EXECHEAP, EXECSTACK, and EXECMOD checks.
> Mark default_noexec as ro_after_init to prevent later clearing it
> and thereby disabling these checks.  It is only set legitimately from
> init code.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>  security/selinux/hooks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Merged into selinux/next, thanks!

-- 
paul moore
www.paul-moore.com