Commit 277d342f authored by Paul Moore's avatar Paul Moore
Browse files

selinux: Deprecate and schedule the removal of the the compat_net functionality 



This patch is the first step towards removing the old "compat_net" code from
the kernel.  Secmark, the "compat_net" replacement was first introduced in
2.6.18 (September 2006) and the major Linux distributions with SELinux support
have transitioned to Secmark so it is time to start deprecating the "compat_net"
mechanism.  Testing a patched version of 2.6.28-rc6 with the initial release of
Fedora Core 5 did not show any problems when running in enforcing mode.

This patch adds an entry to the feature-removal-schedule.txt file and removes
the SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT configuration option, forcing
Secmark on by default although it can still be disabled at runtime.  The patch
also makes the Secmark permission checks "dynamic" in the sense that they are
only executed when Secmark is configured; this should help prevent problems
with older distributions that have not yet migrated to Secmark.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Acked-by: default avatarJames Morris <jmorris@namei.org>
parent 6c2e8ac0

Documentation/feature-removal-schedule.txt

+12 −0
Original line number Diff line number Diff line
@@ -324,3 +324,15 @@ When: 2.6.29 (ideally) or 2.6.30 (more likely) 
Why:	Deprecated by the new (standard) device driver binding model. Use

	i2c_driver->probe() and ->remove() instead.

Who:	Jean Delvare <khali@linux-fr.org>



---------------------------



What:	SELinux "compat_net" functionality

When:	2.6.30 at the earliest

Why:	In 2.6.18 the Secmark concept was introduced to replace the "compat_net"

	network access control functionality of SELinux.  Secmark offers both

	better performance and greater flexibility than the "compat_net"

	mechanism.  Now that the major Linux distributions have moved to

	Secmark, it is time to deprecate the older mechanism and start the

	process of removing the old code.

Who:	Paul Moore <paul.moore@hp.com>

security/selinux/Kconfig

+0 −27
Original line number Diff line number Diff line
@@ -94,33 +94,6 @@ config SECURITY_SELINUX_CHECKREQPROT_VALUE 


	  If you are unsure how to answer this question, answer 1.



config SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT

	bool "NSA SELinux enable new secmark network controls by default"

	depends on SECURITY_SELINUX

	default n

	help

	  This option determines whether the new secmark-based network

	  controls will be enabled by default.  If not, the old internal

	  per-packet controls will be enabled by default, preserving

	  old behavior.



	  If you enable the new controls, you will need updated

	  SELinux userspace libraries, tools and policy.  Typically,

	  your distribution will provide these and enable the new controls

	  in the kernel they also distribute.



	  Note that this option can be overridden at boot with the

	  selinux_compat_net parameter, and after boot via

	  /selinux/compat_net.  See Documentation/kernel-parameters.txt

	  for details on this parameter.



	  If you enable the new network controls, you will likely

	  also require the SECMARK and CONNSECMARK targets, as

	  well as any conntrack helpers for protocols which you

	  wish to control.



	  If you are unsure what to do here, select N.



config SECURITY_SELINUX_POLICYDB_VERSION_MAX

	bool "NSA SELinux maximum supported policy format version"

	depends on SECURITY_SELINUX

security/selinux/hooks.c

+3 −3
Original line number Diff line number Diff line
@@ -4185,7 +4185,7 @@ static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk, 
static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,

				       u16 family)

{

	int err;

	int err = 0;

	struct sk_security_struct *sksec = sk->sk_security;

	u32 peer_sid;

	u32 sk_sid = sksec->sid;
@@ -4202,7 +4202,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, 
	if (selinux_compat_net)

		err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,

							   family, addrp);

	else

	else if (selinux_secmark_enabled())

		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,

				   PACKET__RECV, &ad);

	if (err)
@@ -4705,7 +4705,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, 
		if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,

							 &ad, family, addrp))

			return NF_DROP;

	} else {

	} else if (selinux_secmark_enabled()) {

		if (avc_has_perm(sksec->sid, skb->secmark,

				 SECCLASS_PACKET, PACKET__SEND, &ad))

			return NF_DROP;

security/selinux/selinuxfs.c

+8 −8
Original line number Diff line number Diff line
@@ -47,13 +47,7 @@ static char *policycap_names[] = { 


unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;



#ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT

#define SELINUX_COMPAT_NET_VALUE 0

#else

#define SELINUX_COMPAT_NET_VALUE 1

#endif



int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;

int selinux_compat_net = 0;



static int __init checkreqprot_setup(char *str)

{
@@ -494,7 +488,13 @@ static ssize_t sel_write_compat_net(struct file *file, const char __user *buf, 
	if (sscanf(page, "%d", &new_value) != 1)

		goto out;



	selinux_compat_net = new_value ? 1 : 0;

	if (new_value) {

		printk(KERN_NOTICE

		       "SELinux: compat_net is deprecated, please use secmark"

		       " instead\n");

		selinux_compat_net = 1;

	} else

		selinux_compat_net = 0;

	length = count;

out:

	free_page((unsigned long) page);

CRA Git | Maintained and supported by SUSTech CRA and CCSE