On Thu, Sep 10, 2020 at 8:34 AM Stephen Smalley <stephen.smalley.work@xxxxxxxxx> wrote: > On Thu, Sep 10, 2020 at 7:39 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote: > > On Wed, Aug 19, 2020 at 9:07 PM Stephen Smalley > > <stephen.smalley.work@xxxxxxxxx> wrote: > > > On Wed, Aug 19, 2020 at 1:15 PM Petr Lautrbach <plautrba@xxxxxxxxxx> wrote: > > <snip> > > > > So I've started to compose Fedora Change proposal > > > > > > > > https://fedoraproject.org/wiki/SELinux/Changes/Disable_CONFIG_SECURITY_SELINUX_DISABLE > > > > > > > > It's not complete yet, but I believe it contains basic information. I'd > > > > appreciate if you can help me with text, phrases and references so that it would > > > > be easy to sell it as security feature to Fedora community :) > > > > > > I'd simplify the Summary to be something like "Remove support for > > > SELinux runtime disable so that the LSM hooks can be hardened via > > > read-only-after-initialization protections. Migrate users to using > > > selinux=0 if they want to disable SELinux." > > > > FYI, the change proposal has now been announced to the Fedora devel community: > > https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/thread/YQIYMWKFQEWCILU7UZWXO3YFNS2PLDG4/ > > Speaking of this, I noticed that Documentation/ABI/README says that > files under obsolete should say when to expect the interface to be > removed, and at least a couple of them do, e.g. > sysfs-class-net-batman-adv:This ABI is deprecated and will be removed > after 2021. > > Should we add similar lines to the two sysfs-selinux-* files, and if > so, what target date should we propose for each? Sorry, I overlooked the updates to this thread in my inbox until I saw the LWN article today and revisited this thread. The lack of a specific date in the disable sysctl was a deliberate omission on my part as when the commit was made it wasn't clear when Fedora would be ready to make the transition. As we documented in the the sysfs-selinux-disable obsolescence notice: "Fedora is in the process of removing the selinuxfs "disable" node and once that is complete we will start the slow process of removing this code from the kernel." As far as the checkreqprot notice is concerned, it probably would be a good idea to outline a process for its eventual removal. It isn't quite the same as the runtime disable issue since the distro work should all be done at this point, it's just a matter of finally blocking any "1" writes. The deprecation made its first appearance in v5.7, which was released in June 2020, and a year seems like a reasonable amount of time for this so perhaps we target summer 2021? -- paul moore www.paul-moore.com
