diff options
| author |   Stephen Smalley <sds@tycho.nsa.gov> | 2020-01-08 12:23:56 -0500 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2020-01-10 12:26:20 -0500 |
| commit | b78b7d59bdbe6028ab362c2551dc684872f2052a (patch) | |
| tree | 0fdca3b57d0e335a61ea3de4a5b5469dd05df296 /security/selinux/include/security.h | |
| parent | selinux: move ibpkeys code under CONFIG_SECURITY_INFINIBAND. (diff) | |
| download | linux-dev-b78b7d59bdbe6028ab362c2551dc684872f2052a.tar.xz linux-dev-b78b7d59bdbe6028ab362c2551dc684872f2052a.zip | |
selinux: make default_noexec read-only after init
SELinux checks whether VM_EXEC is set in the VM_DATA_DEFAULT_FLAGS
during initialization and saves the result in default_noexec for use
in its mmap and mprotect hook function implementations to decide
whether to apply EXECMEM, EXECHEAP, EXECSTACK, and EXECMOD checks.
Mark default_noexec as ro_after_init to prevent later clearing it
and thereby disabling these checks. It is only set legitimately from
init code.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/include/security.h')
0 files changed, 0 insertions, 0 deletions