[kernel-hardening] [RFC PATCH 0/4] ro hardening for the security subsystem

[kernel-hardening] [RFC PATCH 0/4] ro hardening for the security subsystem

[James Morris]

Hi Folks,

Please review/test these patches which add some read-only hardening to the 
security subsystem.

In this series, the following are marked as __ro_after_init:

- LSM hooks
- Netfilter hooks used by security/
- the default IMA rules

I've also constified the SELinux Netlink permission tables, which will 
ensure they're located in an RO section.

---

James Morris (4):
  security: mark LSM hooks as __ro_after_init
  security: mark nf ops in SELinux and Smack as __ro_after_init
  integrity: mark default IMA rules as __ro_after_init
  selinux: constify nlmsg permission tables

 security/apparmor/lsm.c             |    2 +-
 security/commoncap.c                |    2 +-
 security/integrity/ima/ima_policy.c |    8 ++++----
 security/loadpin/loadpin.c          |    2 +-
 security/security.c                 |    2 +-
 security/selinux/hooks.c            |    4 ++--
 security/selinux/nlmsgtab.c         |   10 +++++-----
 security/smack/smack_lsm.c          |    2 +-
 security/smack/smack_netfilter.c    |    2 +-
 security/tomoyo/tomoyo.c            |    2 +-
 security/yama/yama_lsm.c            |    2 +-
 11 files changed, 19 insertions(+), 19 deletions(-)


-- 
James Morris
<jmorris@namei.org>

Re: [kernel-hardening] [RFC PATCH 0/4] ro hardening for the security subsystem

[Kees Cook]

On Sun, Feb 12, 2017 at 9:31 PM, James Morris <jmorris@namei.org> wrote:
> Hi Folks,
>
> Please review/test these patches which add some read-only hardening to the
> security subsystem.
>
> In this series, the following are marked as __ro_after_init:
>
> - LSM hooks
> - Netfilter hooks used by security/
> - the default IMA rules
>
> I've also constified the SELinux Netlink permission tables, which will
> ensure they're located in an RO section.

A lot of the security subsystem is targeted during kernel write
exploits, so I think this is very nice change to have. Thanks for
doing this!

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

-- 
Kees Cook
Pixel Security