From patchwork Fri Jul 28 15:01:49 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 127717 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:918b:0:b0:3e4:2afc:c1 with SMTP id s11csp526409vqg; Fri, 28 Jul 2023 08:51:12 -0700 (PDT) X-Google-Smtp-Source: APBJJlFGEPX9YwJ9cUNh8J92E/QCxwT1RJ3eyzzFYWvGFDsa7YKYiTC1an7hktrIr2kYznUoXbqw X-Received: by 2002:a05:6a21:3284:b0:136:ea0e:d23 with SMTP id yt4-20020a056a21328400b00136ea0e0d23mr2182630pzb.11.1690559471879; Fri, 28 Jul 2023 08:51:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690559471; cv=none; d=google.com; s=arc-20160816; b=R0vBMZrzMfnrfUcENp/QSMdCMVER/Zu72l0eiS+QFLdDgcdTQO5sSI2i9b8Pc0yF+Q aHsuZZXXQU5Ll3sBZs6StggL+tP94VRghgngR68yjocSbCzEpbP2rNS8t67yzfh6p8uF /vjt7RV+JcYKlGalDAqwWiPmyNoLPxpgLK6Jf6tgbNLnGWZEa4ZXF2ah9Xfwna5bDHAW XeR1FegDVRB3zndi+z9krHlyyx3yUkKWDYxK6LYDk8W7RIxfq1mPcRWfcQ8RFfirW/4O 8XkxSwIDCB11HBn1XWQ2LM0SxNafp8/aLGJzWG7q/xt2FgrI0qdiGRLNmL+FC8xyELfI /CLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=4RwtXxw18kFYFi2O6VgR0yT2o2eoXEI7h/e+lf2SMqQ=; fh=QKur2PFwoLuCt27JzfZM4LabS9ldoGoSAJNPH9t/KWI=; b=wovXzvji42OrkAn/lAQiiuHBcQ72KJzuNBfk/0a2EDdfRi5TLMMhmhSLoOlXA5bHmK 7zocJ2h+6YqGpT3ZlqJNE7Bfk7UKhcxUKdLA5QgGR9Y+DyExLERl/nNSPY2q9Rty0eDu SpMeKfHb88Bga/2+hiDQSg2KnTIrjsd1yN2y4wZPr/TJ48bT78ht+mdBDCEv58MAloMM UWtG320z70Y1Y6kfpnAQyj6p5DCYYRkURMPzKvPZwrt2q+f9OPwetdnAxHiEwi2r+WDI 5U9yFGcWJ2aYMgKtQNg1CVyPCECQkixVtKP9Frv5bC7pTVNM1DcKrwmilokpyUrQO1d5 pkvw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b="E6fh8Cd/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l123-20020a633e81000000b0055befc89e11si3276472pga.84.2023.07.28.08.50.58; Fri, 28 Jul 2023 08:51:11 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b="E6fh8Cd/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237300AbjG1PCM (ORCPT + 99 others); Fri, 28 Jul 2023 11:02:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237301AbjG1PCJ (ORCPT ); Fri, 28 Jul 2023 11:02:09 -0400 Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 564362115; Fri, 28 Jul 2023 08:02:00 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id 38308e7fff4ca-2b9a828c920so36329441fa.1; Fri, 28 Jul 2023 08:02:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1690556518; x=1691161318; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=4RwtXxw18kFYFi2O6VgR0yT2o2eoXEI7h/e+lf2SMqQ=; b=E6fh8Cd/oWqNYEuaYRga4hh31zIDKc5UymmfTHUgU89GmVQeA5uqP69u0/20Lf1Y6f oKdPmOmhGbm6eVo616eZ9TrETZDTnXb0NSy+8rzPKic9IaRyv+IcA23Ed0gKN2YuMiI9 v04BuKX+jsW5bTuNQfax85LEsbOaGbLnXH//Cwpmn0gBZZZjzXmD8xocd7KVraw33mh1 l//m1nlNUo+KCROaibxKQFJGogZl8/AS8wPGDvaZrqdkqkiK6Ps2ldMPZzjRZQdcQRqC Dy4jJtPzwQ5TOtAYznt7q6mb9aRtZeNtoqVDAJ5D15tl0SHgxI1t7LnlWuHPbJcl4HIO LPOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690556518; x=1691161318; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=4RwtXxw18kFYFi2O6VgR0yT2o2eoXEI7h/e+lf2SMqQ=; b=M4dthWw3jTeCuFL+aFKSoS8NQRgd+jArQHwMpj1/A5BTr1FJ42ymGj9VU3tfZ+zfcO SJ4hVJGVQyYZFkfOB5Xe+bgz/FxdLffGtav8QCcOUdUb8Lx7HTMCiiFTFtPNpxFLR/Ry CSfgvCuVtYXMLyd0RdM/RntJMnTY84F7AsDX/x2Lsx/ohI8q2L4xHqq5mp2mU5s326Ua uCvCCYpjGgR6OdzFkZ3FmB8qtT7O47v5+OpONRT4Pux3/XYcASQpzhJRUT9ZcWPMf4Ad UB9X6yYoG5hTpyPrWfddqWANYfFPZ59tzXENo4scrHxPYVFwR0hmtfmQPz2QCA5wUPxl BekQ== X-Gm-Message-State: ABy/qLaOb80oER4X6tzDLTM/49a30p4uWpCr+hdA4cQLnPXV82Z/+dCJ lc4P/3wCZ+MlpE3FAFLpPIl0Detly+7Scc87 X-Received: by 2002:a2e:7807:0:b0:2b6:e958:5700 with SMTP id t7-20020a2e7807000000b002b6e9585700mr2028137ljc.4.1690556518144; Fri, 28 Jul 2023 08:01:58 -0700 (PDT) Received: from debian_development.DebianHome (dynamic-077-000-157-016.77.0.pool.telefonica.de. [77.0.157.16]) by smtp.gmail.com with ESMTPSA id w23-20020a170906481700b009927d4d7a6bsm2143370ejq.53.2023.07.28.08.01.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Jul 2023 08:01:57 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Paul Moore , Stephen Smalley , Eric Paris , linux-kernel@vger.kernel.org Subject: [PATCH v2] selinux: log about VM being executable by default Date: Fri, 28 Jul 2023 17:01:49 +0200 Message-Id: <20230728150150.16224-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772680088821150692 X-GMAIL-MSGID: 1772680088821150692 In case virtual memory is being marked as executable by default, SELinux checks regarding explicit potential dangerous use are disabled. Inform the user about it. Signed-off-by: Christian Göttsche --- v2: shorten message as suggested by Paul --- security/selinux/hooks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 5194f12def97..7cd687284563 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -7265,6 +7265,8 @@ static __init int selinux_init(void) cred_init_security(); default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC); + if (!default_noexec) + pr_notice("SELinux: virtual memory is executable by default\n"); avc_init();