diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 81f570cffee51d03cb3fa8b03a1b8f55e184cf84..921283f47862edd4c3ed69785beb4ee36e83c721 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3647,7 +3647,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
 	return error;
 }
 
-static int default_noexec;
+static int default_noexec __ro_after_init;
 
 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
 {