* [RFC PATCH] selinux: log about VM being executable by default
@ 2023-07-20 10:35 Christian Göttsche
2023-07-20 20:45 ` Paul Moore
0 siblings, 1 reply; 2+ messages in thread
From: Christian Göttsche @ 2023-07-20 10:35 UTC (permalink / raw)
To: selinux; +Cc: Paul Moore, Stephen Smalley, Eric Paris, linux-kernel
In case virtual memory is being marked as executable by default, SELinux
checks regarding explicit potential dangerous use are disabled.
Inform the user about it.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
security/selinux/hooks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6f53fa71fbdb..3a7ece84c2cc 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7265,6 +7265,8 @@ static __init int selinux_init(void)
cred_init_security();
default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
+ if (!default_noexec)
+ pr_notice("SELinux: virtual memory is executable by default - related checks disabled\n");
avc_init();
--
2.40.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [RFC PATCH] selinux: log about VM being executable by default
2023-07-20 10:35 [RFC PATCH] selinux: log about VM being executable by default Christian Göttsche
@ 2023-07-20 20:45 ` Paul Moore
0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2023-07-20 20:45 UTC (permalink / raw)
To: Christian Göttsche
Cc: selinux, Stephen Smalley, Eric Paris, linux-kernel
On Thu, Jul 20, 2023 at 6:36 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> In case virtual memory is being marked as executable by default, SELinux
> checks regarding explicit potential dangerous use are disabled.
>
> Inform the user about it.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 6f53fa71fbdb..3a7ece84c2cc 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -7265,6 +7265,8 @@ static __init int selinux_init(void)
> cred_init_security();
>
> default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
> + if (!default_noexec)
> + pr_notice("SELinux: virtual memory is executable by default - related checks disabled\n");
Let's keep things concise and simply say that "virtual memory is
executable by default", dropping the last part about "related checks".
>
> avc_init();
>
> --
> 2.40.1
--
paul-moore.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-07-20 20:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-20 10:35 [RFC PATCH] selinux: log about VM being executable by default Christian Göttsche
2023-07-20 20:45 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®