diff mbox series

[RFC] selinux: log about VM being executable by default

Message ID 20230720103549.25255-1-cgzones@googlemail.com (mailing list archive)
State Changes Requested
Delegated to: Paul Moore
Headers show
Series [RFC] selinux: log about VM being executable by default | expand

Commit Message

Christian Göttsche July 20, 2023, 10:35 a.m. UTC 
In case virtual memory is being marked as executable by default, SELinux
checks regarding explicit potential dangerous use are disabled.

Inform the user about it.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/hooks.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Paul Moore July 20, 2023, 8:45 p.m. UTC | #1 
On Thu, Jul 20, 2023 at 6:36 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> In case virtual memory is being marked as executable by default, SELinux
> checks regarding explicit potential dangerous use are disabled.
>
> Inform the user about it.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 6f53fa71fbdb..3a7ece84c2cc 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -7265,6 +7265,8 @@ static __init int selinux_init(void)
>         cred_init_security();
>
>         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
> +       if (!default_noexec)
> +               pr_notice("SELinux:  virtual memory is executable by default - related checks disabled\n");

Let's keep things concise and simply say that "virtual memory is
executable by default", dropping the last part about "related checks".

>
>         avc_init();
>
> --
> 2.40.1
diff mbox series

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6f53fa71fbdb..3a7ece84c2cc 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7265,6 +7265,8 @@  static __init int selinux_init(void)
 	cred_init_security();
 
 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
+	if (!default_noexec)
+		pr_notice("SELinux:  virtual memory is executable by default - related checks disabled\n");
 
 	avc_init();