Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230720103549.25255-1-cgzones@googlemail.com>
In-Reply-To: <20230720103549.25255-1-cgzones@googlemail.com>
From:   Paul Moore <paul@paul-moore.com>
Date:   Thu, 20 Jul 2023 16:45:27 -0400
Message-ID: <CAHC9VhQKMcU=Bmt=CBVywRFDg+=6YGd+UOkNQ1gKytTgAMOgGA@mail.gmail.com>
Subject: Re: [RFC PATCH] selinux: log about VM being executable by default
To:     =?UTF-8?Q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com>
Cc:     selinux@vger.kernel.org,
        Stephen Smalley <stephen.smalley.work@gmail.com>,
        Eric Paris <eparis@parisplace.org>,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Jul 20, 2023 at 6:36=E2=80=AFAM Christian G=C3=B6ttsche
<cgzones@googlemail.com> wrote:
>
> In case virtual memory is being marked as executable by default, SELinux
> checks regarding explicit potential dangerous use are disabled.
>
> Inform the user about it.
>
> Signed-off-by: Christian G=C3=B6ttsche <cgzones@googlemail.com>
> ---
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 6f53fa71fbdb..3a7ece84c2cc 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -7265,6 +7265,8 @@ static __init int selinux_init(void)
>         cred_init_security();
>
>         default_noexec =3D !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
> +       if (!default_noexec)
> +               pr_notice("SELinux:  virtual memory is executable by defa=
ult - related checks disabled\n");

Let's keep things concise and simply say that "virtual memory is
executable by default", dropping the last part about "related checks".

>
>         avc_init();
>
> --
> 2.40.1

--=20
paul-moore.com