[PATCH] LSM: allow an LSM to disable all hooks at once
penguin-kernel at i-love.sakura.ne.jp
Thu Dec 12 10:30:54 UTC 2019
On 2019/12/11 23:08, Ondrej Mosnacek wrote:
> As a nice side effect, this allows marking the hooks (and other stuff)
> __ro_after_init unconditionally. Since SECURITY_WRITABLE_HOOKS no longer
> makes sense, remove it and instead use SECURITY_SELINUX_DISABLE directly
> for turning on the runtime disable functionality, to emphasize that this
> is only used by SELinux and is meant to be removed in the future.
I don't like unconditionally marking __ro_after_init. I'm currently waiting for
Casey's stacking work to complete. I haven't given up dynamically loadable LSM modules.
In order to allow loading LSM modules after boot, I have to add lines
1093-1173, 1190-1195, 1208-1211, 1217-1220 in
I suggest grouping __lsm_ro_after_init variables into a special section and
implementing a legal method for temporarily making that section read-write.
Then, architectures with that method will be able to use __ro_after_init marking.
More information about the Linux-security-module-archive