linux-kernel - Re: [RFC PATCH] selinux: log about VM being executable by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHC9VhQKMcU=Bmt=CBVywRFDg+=6YGd+UOkNQ1gKytTgAMOgGA@mail.gmail.com>
Date:   Thu, 20 Jul 2023 16:45:27 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Christian Göttsche <cgzones@...glemail.com>
Cc:     selinux@...r.kernel.org,
        Stephen Smalley <stephen.smalley.work@...il.com>,
        Eric Paris <eparis@...isplace.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] selinux: log about VM being executable by default

On Thu, Jul 20, 2023 at 6:36 AM Christian Göttsche
<cgzones@...glemail.com> wrote:
>
> In case virtual memory is being marked as executable by default, SELinux
> checks regarding explicit potential dangerous use are disabled.
>
> Inform the user about it.
>
> Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
> ---
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 6f53fa71fbdb..3a7ece84c2cc 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -7265,6 +7265,8 @@ static __init int selinux_init(void)
>         cred_init_security();
>
>         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
> +       if (!default_noexec)
> +               pr_notice("SELinux:  virtual memory is executable by default - related checks disabled\n");

Let's keep things concise and simply say that "virtual memory is
executable by default", dropping the last part about "related checks".

>
>         avc_init();
>
> --
> 2.40.1

-- 
paul-moore.com