From: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
The functionality has been deprecated upstream, so let's disable it
procatively in Fedora to not delay the inevitable. We are ready to
inherit this in RHEL-9, so do the change directly in
redhat/configs/common.
Quoting basic information from the Fedora change proposal [1]:
"""
Currently, SELinux can be disabled using selinux=0 on the kernel command
line, or in userspace via /etc/selinux/config. In the latter case,
/etc/selinux/config is read by libselinux userspace library during boot
and if it contains SELINUX=disabled, it writes 1 into
/sys/fs/selinux/disable and unmounts /sys/fs/selinux.
Support for SELinux runtime disable via /etc/selinux/config was
originally developed to make it easier for Linux distributions to
support architectures where adding parameters to the kernel command line
was difficult. Unfortunately, supporting runtime disable meant we had to
make some security trade-offs when it comes to the kernel LSM hooks.
Marking the kernel LSM hooks as read only provides some very nice
security benefits, but it does mean that we can no longer disable
SELinux at runtime. Toggling between enforcing and permissive mode while
booted will remain unaffected and it will still be possible to disable
SELinux by adding selinux=0 to the kernel command line via the boot
loader (GRUB).
System with SELINUX=disabled in /etc/selinux/config will come up with
/sys/fs/selinux unmounted, userspace will detect SELinux as disabled.
Internally SELinux will be enabled but not initialized so that there
will be no SELinux checks applied. This state is very similar to SELinux
disabled - the hooks are active, but they mostly do almost nothing so
there should be very little effect on the time spent in syscalls
compared to SELinux fully disabled.
Runtime disable is considered deprecated by upstream, and using it will
become increasingly painful (e.g. sleeping/blocking) through future
kernel releases until eventually it is removed completely. Current
kernel reports the following message during runtime disable:
SELinux: Runtime disable is deprecated, use selinux=0 on the kernel
cmdline
Additional info:
* https://lwn.net/Articles/666550
* https://lore.kernel.org/selinux/159110207843.57260.5661475689740939480.stgit@chester/
* https://lore.kernel.org/selinux/157836784986.560897.13893922675143903084.stgit@chester/#t
"""
[1] https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable
Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
---
redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE b/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE
index 82137a083af0..958d6c0bd24a 100644
--- a/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE
+++ b/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE
@@ -1 +1 @@
-CONFIG_SECURITY_SELINUX_DISABLE=y
+# CONFIG_SECURITY_SELINUX_DISABLE is not set
--
GitLab
_______________________________________________
kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
