From: Nick Desaulniers <ndesaulniers@google.com>
To: pnagar@codeaurora.org
Cc: arnd@arndb.de, dsule@codeaurora.org, eparis@parisplace.org,
jmorris@namei.org, joe@perches.com, linux-arch@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, jeffv@google.com,
nmardana@codeaurora.org, ojeda@kernel.org, paul@paul-moore.com,
psodagud@codeaurora.org, selinux@vger.kernel.org,
serge@hallyn.com, stephen.smalley.work@gmail.com
Subject: Re: [RFC PATCH v2] selinux: security: Move selinux_state to a separate page
Date: Fri, 8 Jan 2021 17:01:11 -0800 [thread overview]
Message-ID: <20210109010111.2299669-1-ndesaulniers@google.com> (raw)
In-Reply-To: <1610099389-28329-1-git-send-email-pnagar@codeaurora.org>
Via:
https://lore.kernel.org/lkml/1610099389-28329-1-git-send-email-pnagar@codeaurora.org/
> diff --git a/include/linux/init.h b/include/linux/init.h
> index 7b53cb3..617adcf 100644
> --- a/include/linux/init.h
> +++ b/include/linux/init.h
> @@ -300,6 +300,10 @@ void __init parse_early_options(char *cmdline);
> /* Data marked not to be saved by software suspend */
> #define __nosavedata __section(".data..nosave")
>
> +#ifdef CONFIG_SECURITY_RTIC
> +#define __rticdata __section(".bss.rtic")
if you put:
#else
#define __rticdata
here, then you wouldn't need to label each datum you put in there.
> +#endif
> +
> #ifdef MODULE
> #define __exit_p(x) x
> #else
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -104,7 +104,11 @@
> #include "audit.h"
> #include "avc_ss.h"
>
> +#ifdef CONFIG_SECURITY_RTIC
> +struct selinux_state selinux_state __rticdata;
> +#else
> struct selinux_state selinux_state;
> +#endif
so you could then drop the if-def here.
Happy to see this resolved when building with LLD+LTO, which has been a
problem in the past.
Disabling selinux is a common attack vector on Android devices, so happy
to see some effort towards mitigation. You might want to communicate
the feature more to existing OEMs that are using your chipsets that
support this feature.
next prev parent reply other threads:[~2021-01-09 1:02 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-08 9:49 [RFC PATCH v2] selinux: security: Move selinux_state to a separate page Preeti Nagar
2021-01-08 15:25 ` Miguel Ojeda
2021-01-11 6:25 ` pnagar
2021-01-08 15:28 ` Miguel Ojeda
2021-01-08 17:11 ` Casey Schaufler
2021-01-12 9:36 ` pnagar
2021-01-12 17:06 ` Casey Schaufler
2021-01-13 10:56 ` David Howells
2021-01-18 6:15 ` pnagar
2021-01-09 1:01 ` Nick Desaulniers [this message]
2021-01-11 9:51 ` pnagar
2021-01-18 5:56 pnagar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210109010111.2299669-1-ndesaulniers@google.com \
--to=ndesaulniers@google.com \
--cc=arnd@arndb.de \
--cc=dsule@codeaurora.org \
--cc=eparis@parisplace.org \
--cc=jeffv@google.com \
--cc=jmorris@namei.org \
--cc=joe@perches.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nmardana@codeaurora.org \
--cc=ojeda@kernel.org \
--cc=paul@paul-moore.com \
--cc=pnagar@codeaurora.org \
--cc=psodagud@codeaurora.org \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).