From patchwork Mon Feb 13 05:33:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Morris X-Patchwork-Id: 9568779 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8C1EF60572 for ; Mon, 13 Feb 2017 05:33:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7ABF12808F for ; Mon, 13 Feb 2017 05:33:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6D9E428178; Mon, 13 Feb 2017 05:33:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 061D82808F for ; Mon, 13 Feb 2017 05:33:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751483AbdBMFd0 (ORCPT ); Mon, 13 Feb 2017 00:33:26 -0500 Received: from namei.org ([65.99.196.166]:34515 "EHLO namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751014AbdBMFd0 (ORCPT ); Mon, 13 Feb 2017 00:33:26 -0500 Received: from localhost (localhost [127.0.0.1]) by namei.org (8.14.4/8.14.4) with ESMTP id v1D5XD1A009161; Mon, 13 Feb 2017 05:33:13 GMT Date: Mon, 13 Feb 2017 16:33:13 +1100 (AEDT) From: James Morris To: linux-security-module@vger.kernel.org cc: kernel-hardening@lists.openwall.com Subject: [RFC PATCH 2/4] security: mark nf ops in SELinux and Smack as __ro_after_init Message-ID: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Both SELinux and Smack register Netfilter operations during init, which then don't change. Mark these ops as __ro_after_init. Signed-off-by: James Morris --- security/selinux/hooks.c | 2 +- security/smack/smack_netfilter.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 9599e97..37a7866 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6379,7 +6379,7 @@ void selinux_complete_init(void) #if defined(CONFIG_NETFILTER) -static struct nf_hook_ops selinux_nf_ops[] = { +static struct nf_hook_ops selinux_nf_ops[] __ro_after_init = { { .hook = selinux_ipv4_postroute, .pf = NFPROTO_IPV4, diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 205b785..b945f2c 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -57,7 +57,7 @@ static unsigned int smack_ipv4_output(void *priv, return NF_ACCEPT; } -static struct nf_hook_ops smack_nf_ops[] = { +static struct nf_hook_ops smack_nf_ops[] __ro_after_init = { { .hook = smack_ipv4_output, .pf = NFPROTO_IPV4,