On Thu, Oct 8, 2020 at 5:31 AM GitLab Bridge on behalf of omos <cki-gitlab@xxxxxxxxxx> wrote: > > From: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > > The functionality has been deprecated upstream, so let's disable it > procatively in Fedora to not delay the inevitable. We are ready to > inherit this in RHEL-9, so do the change directly in > redhat/configs/common. This is already planned through the Fedora 34 change that you reference. It will not be turned off before then. At this time, the plan is to turn it off beginning with 5.10 kernels, and then to ensure that the change does not propagate down to Fedora 32/33. Justin > Quoting basic information from the Fedora change proposal [1]: > """ > Currently, SELinux can be disabled using selinux=0 on the kernel command > line, or in userspace via /etc/selinux/config. In the latter case, > /etc/selinux/config is read by libselinux userspace library during boot > and if it contains SELINUX=disabled, it writes 1 into > /sys/fs/selinux/disable and unmounts /sys/fs/selinux. > > Support for SELinux runtime disable via /etc/selinux/config was > originally developed to make it easier for Linux distributions to > support architectures where adding parameters to the kernel command line > was difficult. Unfortunately, supporting runtime disable meant we had to > make some security trade-offs when it comes to the kernel LSM hooks. > > Marking the kernel LSM hooks as read only provides some very nice > security benefits, but it does mean that we can no longer disable > SELinux at runtime. Toggling between enforcing and permissive mode while > booted will remain unaffected and it will still be possible to disable > SELinux by adding selinux=0 to the kernel command line via the boot > loader (GRUB). > > System with SELINUX=disabled in /etc/selinux/config will come up with > /sys/fs/selinux unmounted, userspace will detect SELinux as disabled. > Internally SELinux will be enabled but not initialized so that there > will be no SELinux checks applied. This state is very similar to SELinux > disabled - the hooks are active, but they mostly do almost nothing so > there should be very little effect on the time spent in syscalls > compared to SELinux fully disabled. > > Runtime disable is considered deprecated by upstream, and using it will > become increasingly painful (e.g. sleeping/blocking) through future > kernel releases until eventually it is removed completely. Current > kernel reports the following message during runtime disable: > > SELinux: Runtime disable is deprecated, use selinux=0 on the kernel > cmdline > > Additional info: > * https://lwn.net/Articles/666550 > * https://lore.kernel.org/selinux/159110207843.57260.5661475689740939480.stgit@chester/ > * https://lore.kernel.org/selinux/157836784986.560897.13893922675143903084.stgit@chester/#t > """ > > [1] https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > --- > redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE b/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE > index 82137a083af0..958d6c0bd24a 100644 > --- a/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE > +++ b/redhat/configs/common/generic/CONFIG_SECURITY_SELINUX_DISABLE > @@ -1 +1 @@ > -CONFIG_SECURITY_SELINUX_DISABLE=y > +# CONFIG_SECURITY_SELINUX_DISABLE is not set > -- > GitLab > _______________________________________________ > kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
