diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2020-01-08 12:23:56 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2020-01-10 12:26:20 -0500 |
| commit | b78b7d59bdbe6028ab362c2551dc684872f2052a (patch) | |
| tree | 0fdca3b57d0e335a61ea3de4a5b5469dd05df296 /security/selinux | |
| parent | fe49c7e4f85a9b2c3628e2f21e973ea6e26d2be7 (diff) | |
selinux: make default_noexec read-only after init
SELinux checks whether VM_EXEC is set in the VM_DATA_DEFAULT_FLAGS
during initialization and saves the result in default_noexec for use
in its mmap and mprotect hook function implementations to decide
whether to apply EXECMEM, EXECHEAP, EXECSTACK, and EXECMOD checks.
Mark default_noexec as ro_after_init to prevent later clearing it
and thereby disabling these checks. It is only set legitimately from
init code.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux')
| -rw-r--r-- | security/selinux/hooks.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 81f570cffee5..921283f47862 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3647,7 +3647,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, return error; } -static int default_noexec; +static int default_noexec __ro_after_init; static int file_map_prot_check(struct file *file, unsigned long prot, int shared) { |