From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Wed, 8 Jan 2020 17:23:56 +0000 (-0500)
Subject: selinux: make default_noexec read-only after init
X-Git-Tag: v5.6-rc1~181^2~7
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b78b7d59bdbe6028ab362c2551dc684872f2052a;p=thirdparty%2Fkernel%2Flinux.git

selinux: make default_noexec read-only after init

SELinux checks whether VM_EXEC is set in the VM_DATA_DEFAULT_FLAGS
during initialization and saves the result in default_noexec for use
in its mmap and mprotect hook function implementations to decide
whether to apply EXECMEM, EXECHEAP, EXECSTACK, and EXECMOD checks.
Mark default_noexec as ro_after_init to prevent later clearing it
and thereby disabling these checks.  It is only set legitimately from
init code.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 81f570cffee51..921283f47862e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3647,7 +3647,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
 	return error;
 }
 
-static int default_noexec;
+static int default_noexec __ro_after_init;
 
 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
 {