Commit 89b223bf authored by Paul Moore's avatar Paul Moore
Browse files

selinux: deprecate disabling SELinux and runtime 



Deprecate the CONFIG_SECURITY_SELINUX_DISABLE functionality.  The
code was originally developed to make it easier for Linux
distributions to support architectures where adding parameters to the
kernel command line was difficult.  Unfortunately, supporting runtime
disable meant we had to make some security trade-offs when it came to
the LSM hooks, as documented in the Kconfig help text:

  NOTE: selecting this option will disable the '__ro_after_init'
  kernel hardening feature for security hooks.   Please consider
  using the selinux=0 boot parameter instead of enabling this
  option.

Fortunately it looks as if that the original motivation for the
runtime disable functionality is gone, and Fedora/RHEL appears to be
the only major distribution enabling this capability at build time
so we are now taking steps to remove it entirely from the kernel.
The first step is to mark the functionality as deprecated and print
an error when it is used (what this patch is doing).  As Fedora/RHEL
makes progress in transitioning the distribution away from runtime
disable, we will introduce follow-up patches over several kernel
releases which will block for increasing periods of time when the
runtime disable is used.  Finally we will remove the option entirely
once we believe all users have moved to the kernel cmdline approach.

Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Acked-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 7a4b5194

Documentation/ABI/obsolete/sysfs-selinux-disable

0 → 100644
+26 −0
Original line number Diff line number Diff line 
What:		/sys/fs/selinux/disable

Date:		April 2005 (predates git)

KernelVersion:	2.6.12-rc2 (predates git)

Contact:	selinux@vger.kernel.org

Description:



	The selinuxfs "disable" node allows SELinux to be disabled at runtime

	prior to a policy being loaded into the kernel.  If disabled via this

	mechanism, SELinux will remain disabled until the system is rebooted.



	The preferred method of disabling SELinux is via the "selinux=0" boot

	parameter, but the selinuxfs "disable" node was created to make it

	easier for systems with primitive bootloaders that did not allow for

	easy modification of the kernel command line.  Unfortunately, allowing

	for SELinux to be disabled at runtime makes it difficult to secure the

	kernel's LSM hooks using the "__ro_after_init" feature.



	Thankfully, the need for the SELinux runtime disable appears to be

	gone, the default Kconfig configuration disables this selinuxfs node,

	and only one of the major distributions, Fedora, supports disabling

	SELinux at runtime.  Fedora is in the process of removing the

	selinuxfs "disable" node and once that is complete we will start the

	slow process of removing this code from the kernel.



	More information on /sys/fs/selinux/disable can be found under the

	CONFIG_SECURITY_SELINUX_DISABLE Kconfig option.

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -14806,6 +14806,7 @@ F: include/uapi/linux/selinux_netlink.h 
F:	security/selinux/

F:	scripts/selinux/

F:	Documentation/admin-guide/LSM/SELinux.rst

F:	Documentation/ABI/obsolete/sysfs-selinux-disable















SENSABLE PHANTOM















M:	Jiri Slaby <jirislaby@gmail.com>

































security/selinux/Kconfig



+3
−0






























Original line number
Diff line number
Diff line








@@ -42,6 +42,9 @@ config SECURITY_SELINUX_DISABLE













	  using the selinux=0 boot parameter instead of enabling this















	  option.





























	  WARNING: this option is deprecated and will be removed in a future













	  kernel release.





























	  If you are unsure how to answer this question, answer N.































config SECURITY_SELINUX_DEVELOP

































security/selinux/selinuxfs.c



+7
−0






























Original line number
Diff line number
Diff line








@@ -281,6 +281,13 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,













	int new_value;















	int enforcing;





























	/* NOTE: we are now officially considering runtime disable as













	 *       deprecated, and using it will become increasingly painful













	 *       (e.g. sleeping/blocking) as we progress through future













	 *       kernel releases until eventually it is removed













	 */













	pr_err("SELinux:  Runtime disable is deprecated, use selinux=0 on the kernel cmdline.\n");





























	if (count >= PAGE_SIZE)















		return -ENOMEM;



















































































CRA Git | Maintained and supported by SUSTech CRA and CCSE