lkml.org 
[lkml]   [2021]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [RFC PATCH v2] selinux: security: Move selinux_state to a separate page
    From
    Via:
    https://lore.kernel.org/lkml/1610099389-28329-1-git-send-email-pnagar@codeaurora.org/

    > diff --git a/include/linux/init.h b/include/linux/init.h
    > index 7b53cb3..617adcf 100644
    > --- a/include/linux/init.h
    > +++ b/include/linux/init.h
    > @@ -300,6 +300,10 @@ void __init parse_early_options(char *cmdline);
    > /* Data marked not to be saved by software suspend */
    > #define __nosavedata __section(".data..nosave")
    >
    > +#ifdef CONFIG_SECURITY_RTIC
    > +#define __rticdata __section(".bss.rtic")

    if you put:

    #else
    #define __rticdata

    here, then you wouldn't need to label each datum you put in there.

    > +#endif
    > +
    > #ifdef MODULE
    > #define __exit_p(x) x
    > #else

    > --- a/security/selinux/hooks.c
    > +++ b/security/selinux/hooks.c
    > @@ -104,7 +104,11 @@
    > #include "audit.h"
    > #include "avc_ss.h"
    >
    > +#ifdef CONFIG_SECURITY_RTIC
    > +struct selinux_state selinux_state __rticdata;
    > +#else
    > struct selinux_state selinux_state;
    > +#endif

    so you could then drop the if-def here.


    Happy to see this resolved when building with LLD+LTO, which has been a
    problem in the past.

    Disabling selinux is a common attack vector on Android devices, so happy
    to see some effort towards mitigation. You might want to communicate
    the feature more to existing OEMs that are using your chipsets that
    support this feature.

    \
     
     \ /
      Last update: 2021-01-09 02:02    [W:2.536 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site