The patch titled
secmark: disable new controls for SELinux by default
has been removed from the -mm tree. Its filename is
secmark-add-new-packet-controls-to-selinux-disable-new-controls-for-selinux-by-default.patch
This patch was probably dropped from -mm because
it has now been merged into a subsystem tree or
into Linus's tree, or because it was folded into
its parent patch in the -mm tree.
------------------------------------------------------
Subject: secmark: disable new controls for SELinux by default
From: James Morris <jmorris@xxxxxxxxx>
This should address the issue of people tripping over the new secmark
controls when upgrading their kernel before the userland components are
available.
With this patch, the new secmark controls for SElinux are now disabled by
default, so existing behavior is entirely preserved, and the user is not
affected at all.
It also provides a config option to enable the secmark controls by default
(which can always be overridden at boot and runtime). It is also noted in
the kconfig help that the user will need updated userspace if enabling
secmark controls for SELinux and that they'll probably need the SECMARK and
CONNMARK targets, and conntrack protocol helpers, although such decisions
are beyond the scope of kernel configuration.
Signed-off-by: James Morris <jmorris@xxxxxxxxx>
Cc: Stephen Smalley <sds@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
security/selinux/Kconfig | 31 ++++++++++++++++++++++++++++++-
security/selinux/selinuxfs.c | 9 ++++++++-
2 files changed, 38 insertions(+), 2 deletions(-)
diff -puN security/selinux/Kconfig~secmark-add-new-packet-controls-to-selinux-disable-new-controls-for-selinux-by-default security/selinux/Kconfig
--- devel/security/selinux/Kconfig~secmark-add-new-packet-controls-to-selinux-disable-new-controls-for-selinux-by-default 2006-05-22 00:03:05.000000000 -0700
+++ devel-akpm/security/selinux/Kconfig 2006-05-22 00:03:05.000000000 -0700
@@ -1,6 +1,7 @@
config SECURITY_SELINUX
bool "NSA SELinux Support"
- depends on SECURITY_NETWORK && AUDIT && NET && INET && NETWORK_SECMARK
+ depends on SECURITY_NETWORK && AUDIT && NET && INET
+ select NETWORK_SECMARK
default n
help
This selects NSA Security-Enhanced Linux (SELinux).
@@ -95,3 +96,31 @@ config SECURITY_SELINUX_CHECKREQPROT_VAL
via /selinux/checkreqprot if authorized by policy.
If you are unsure how to answer this question, answer 1.
+
+config SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
+ bool "NSA SELinux enable new secmark network controls by default"
+ depends on SECURITY_SELINUX
+ default n
+ help
+ This option determines whether the new secmark-based network
+ controls will be enabled by default. If not, the old internal
+ per-packet controls will be enabled by default, preserving
+ old behavior.
+
+ If you enable the new controls, you will need updated
+ SELinux userspace libraries, tools and policy. Typically,
+ your distribution will provide these and enable the new controls
+ in the kernel they also distribute.
+
+ Note that this option can be overriden at boot with the
+ selinux_compat_net parameter, and after boot via
+ /selinux/compat_net. See Documentation/kernel-parameters.txt
+ for details on this parameter.
+
+ If you enable the new network controls, you will likely
+ also require the SECMARK and CONNSECMARK targets, as
+ well as any conntrack helpers for protocols which you
+ wish to control.
+
+ If you are unsure what do do here, select N.
+
diff -puN security/selinux/selinuxfs.c~secmark-add-new-packet-controls-to-selinux-disable-new-controls-for-selinux-by-default security/selinux/selinuxfs.c
--- devel/security/selinux/selinuxfs.c~secmark-add-new-packet-controls-to-selinux-disable-new-controls-for-selinux-by-default 2006-05-22 00:03:05.000000000 -0700
+++ devel-akpm/security/selinux/selinuxfs.c 2006-05-22 00:03:05.000000000 -0700
@@ -37,7 +37,14 @@
#include "conditional.h"
unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
-int selinux_compat_net;
+
+#ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
+#define SELINUX_COMPAT_NET_VALUE 0
+#else
+#define SELINUX_COMPAT_NET_VALUE 1
+#endif
+
+int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;
static int __init checkreqprot_setup(char *str)
{
_
Patches currently in -mm which might be from jmorris@xxxxxxxxx are
selinux-fix-sb_lock-sb_security_lock-nesting-was.patch
selinux-add-security-class-for-appletalk-sockets.patch
secmark-add-new-flask-definitions-to-selinux.patch
secmark-add-selinux-exports.patch
secmark-add-secmark-support-to-core-networking.patch
secmark-add-xtables-secmark-target.patch
secmark-add-secmark-support-to-conntrack.patch
secmark-add-connsecmark-xtables-target.patch
secmark-add-new-packet-controls-to-selinux.patch
lsm-add-task_setioprio-hook.patch
proc-cleanup-proc_fd_access_allowed.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
