Changes in Kconfig

6f594f5a - selinux: improve debug configuration

Fri, 18 Aug 2023 15:12:14 +0000

selinux: improve debug configurationIf the SELinux debug configuration is enabled define the macro DEBUGsuch that pr_debug() calls are always enabled, regardless ofCONFIG_DYNAMIC_DEBUG, since those message are the main reason for thisconfiguration in the first place.Mention example usage in case CONFIG_DYNAMIC_DEBUG is enabled in thehelp section of the configuration.Signed-off-by: Christian Göttsche Reviewed-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

55a0e738 - selinux: introduce SECURITY_SELINUX_DEBUG configuration

Tue, 18 Jul 2023 18:49:19 +0000

selinux: introduce SECURITY_SELINUX_DEBUG configurationThe policy database code contains several debug output statementsrelated to hashtable utilization. Those are guarded by the macroDEBUG_HASHES, which is neither documented nor set anywhere.Introduce a new Kconfig configuration guarding this and potentialother future debugging related code. Disable the setting by default.Suggested-by: Paul Moore Signed-off-by: Christian Göttsche [PM: fixed line lengths in the help text]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

90aa4f5e - selinux: de-brand SELinux

Tue, 18 Jul 2023 17:13:35 +0000

selinux: de-brand SELinuxChange "NSA SELinux" to just "SELinux" in Kconfig help text andcomments. While NSA was the original primary developer and continues tohelp maintain SELinux, SELinux has long since transitioned to a widecommunity of developers and maintainers. SELinux has been part of themainline Linux kernel for nearly 20 years now [1] and has receivedcontributions from many individuals and organizations.[1] https://lore.kernel.org/lkml/Pine.LNX.4.44.0308082228470.1852-100000@home.osdl.org/Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

f22f9aaf - selinux: remove the runtime disable functionality

Fri, 17 Mar 2023 16:43:07 +0000

selinux: remove the runtime disable functionalityAfter working with the larger SELinux-based distros for severalyears, we're finally at a place where we can disable the SELinuxruntime disable functionality. The existing kernel deprecationnotice explains the functionality and why we want to remove it: The selinuxfs "disable" node allows SELinux to be disabled at runtime prior to a policy being loaded into the kernel. If disabled via this mechanism, SELinux will remain disabled until the system is rebooted. The preferred method of disabling SELinux is via the "selinux=0" boot parameter, but the selinuxfs "disable" node was created to make it easier for systems with primitive bootloaders that did not allow for easy modification of the kernel command line. Unfortunately, allowing for SELinux to be disabled at runtime makes it difficult to secure the kernel's LSM hooks using the "__ro_after_init" feature.It is that last sentence, mentioning the '__ro_after_init' hardening,which is the real motivation for this change, and if you look at thediffstat you'll see that the impact of this patch reaches across allthe different LSMs, helping prevent tampering at the LSM hook level.From a SELinux perspective, it is important to note that if youcontinue to disable SELinux via "/etc/selinux/config" it may appearthat SELinux is disabled, but it is simply in an uninitialized state.If you load a policy with `load_policy -i`, you will see SELinuxcome alive just as if you had loaded the policy during early-boot.It is also worth noting that the "/sys/fs/selinux/disable" file isalways writable now, regardless of the Kconfig settings, but writingto the file has no effect on the system, other than to display anerror on the console if a non-zero/true value is written.Finally, in the several years where we have been working ondeprecating this functionality, there has only been one instance ofsomeone mentioning any user visible breakage. In this particularcase it was an individual's kernel test system, and the workarounddocumented in the deprecation notice ("selinux=0" on the kernelcommand line) resolved the issue without problem.Acked-by: Casey Schaufler Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

a7e4676e - selinux: remove the 'checkreqprot' functionality

Thu, 16 Mar 2023 15:43:08 +0000

selinux: remove the 'checkreqprot' functionalityWe originally promised that the SELinux 'checkreqprot' functionalitywould be removed no sooner than June 2021, and now that it is March2023 it seems like it is a good time to do the final removal. Thedeprecation notice in the kernel provides plenty of detail on why'checkreqprot' is not desirable, with the key point repeated below: This was a compatibility mechanism for legacy userspace and for the READ_IMPLIES_EXEC personality flag. However, if set to 1, it weakens security by allowing mappings to be made executable without authorization by policy. The default value of checkreqprot at boot was changed starting in Linux v4.4 to 0 (i.e. check the actual protection), and Android and Linux distributions have been explicitly writing a "0" to /sys/fs/selinux/checkreqprot during initialization for some time.Along with the official deprecation notice, we have been discussingthis on-list and directly with several of the larger SELinux-baseddistros and everyone is happy to see this feature finally removed.In an attempt to catch all of the smaller, and DIY, Linux systemswe have been writing a deprecation notice URL into the kernel log,along with a growing ssleep() penalty, when admins enabledcheckreqprot at runtime or via the kernel command line. We haveyet to have anyone come to us and raise an objection to thedeprecation or planned removal.It is worth noting that while this patch removes the checkreqprotfunctionality, it leaves the user visible interfaces (kernel commandline and selinuxfs file) intact, just inert. This should helpprevent breakages with existing userspace tools that correctly, butunnecessarily, disable checkreqprot at boot or runtime. Adminsthat attempt to enable checkreqprot will be met with a removalmessage in the kernel log.Acked-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

e9c38f9f - Documentation,selinux: deprecate setting checkreqprot to 1

Wed, 08 Jan 2020 16:24:47 +0000

Documentation,selinux: deprecate setting checkreqprot to 1Deprecate setting the SELinux checkreqprot tunable to 1 via kernelparameter or /sys/fs/selinux/checkreqprot. Setting it to 0 is leftintact for compatibility since Android and some Linux distributionsdo so for security and treat an inability to set it as a fatal error.Eventually setting it to 0 will become a no-op and the kernel willstop using checkreqprot's value internally altogether.checkreqprot was originally introduced as a compatibility mechanismfor legacy userspace and the READ_IMPLIES_EXEC personality flag.However, if set to 1, it weakens security by allowing mappings to bemade executable without authorization by policy. The default valuefor the SECURITY_SELINUX_CHECKREQPROT_VALUE config option was changedfrom 1 to 0 in commit 2a35d196c160e3 ("selinux: changeCONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default") and both Androidand Linux distributions began explicitly setting/sys/fs/selinux/checkreqprot to 0 some time ago.Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

d41415eb - Documentation,selinux: fix references to old selinuxfs mount point

Tue, 07 Jan 2020 16:35:04 +0000

Documentation,selinux: fix references to old selinuxfs mount pointselinuxfs was originally mounted on /selinux, and various docs andkconfig help texts referred to nodes under it. In Linux 3.0,/sys/fs/selinux was introduced as the preferred mount point for selinuxfs.Fix all the old references to /selinux/ to /sys/fs/selinux/.While we are there, update the description of the selinux boot parameterto reflect the fact that the default value is always 1 sincecommit be6ec88f41ba94 ("selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE")and drop discussion of runtime disable since it is deprecated.Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

89b223bf - selinux: deprecate disabling SELinux and runtime

Thu, 19 Dec 2019 02:45:08 +0000

selinux: deprecate disabling SELinux and runtimeDeprecate the CONFIG_SECURITY_SELINUX_DISABLE functionality. Thecode was originally developed to make it easier for Linuxdistributions to support architectures where adding parameters to thekernel command line was difficult. Unfortunately, supporting runtimedisable meant we had to make some security trade-offs when it came tothe LSM hooks, as documented in the Kconfig help text: NOTE: selecting this option will disable the '__ro_after_init' kernel hardening feature for security hooks. Please consider using the selinux=0 boot parameter instead of enabling this option.Fortunately it looks as if that the original motivation for theruntime disable functionality is gone, and Fedora/RHEL appears to bethe only major distribution enabling this capability at build timeso we are now taking steps to remove it entirely from the kernel.The first step is to mark the functionality as deprecated and printan error when it is used (what this patch is doing). As Fedora/RHELmakes progress in transitioning the distribution away from runtimedisable, we will introduce follow-up patches over several kernelreleases which will block for increasing periods of time when theruntime disable is used. Finally we will remove the option entirelyonce we believe all users have moved to the kernel cmdline approach.Acked-by: Casey Schaufler Acked-by: Ondrej Mosnacek Acked-by: Stephen Smalley Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

d97bd23c - selinux: cache the SID -> context string translation

Tue, 26 Nov 2019 13:57:00 +0000

selinux: cache the SID -> context string translationTranslating a context struct to string can be quite slow, especially ifthe context has a lot of category bits set. This can cause quitenoticeable performance impact in situations where the translation needsto be done repeatedly. A common example is a UNIX datagram socket withthe SO_PASSSEC option enabled, which is used e.g. by systemd-journaldwhen receiving log messages via datagram socket. This scenario can bereproduced with: cat /dev/urandom | base64 | logger & timeout 30s perf record -p $(pidof systemd-journald) -a -g kill %1 perf report -g none --pretty raw | grep security_secid_to_secctxBefore the caching introduced by this patch, computing the contextstring (security_secid_to_secctx() function) takes up ~65% ofsystemd-journald's CPU time (assuming a context with 1024 categoriesset and Fedora x86_64 release kernel configs). After this patch(assuming near-perfect cache hit ratio) this overhead is reduced to just~2%.This patch addresses the issue by caching a certain number (compile-timeconfigurable) of recently used context strings to speed up repeatedtranslations of the same context, while using only a small amount ofmemory.The cache is integrated into the existing sidtab table by adding a fieldto each entry, which when not NULL contains an RCU-protected pointer toa cache entry containing the cached string. The cache entries are keptin a linked list sorted according to how recently they were used. On acache miss when the cache is full, the least recently used entry isremoved to make space for the new entry.The patch migrates security_sid_to_context_core() to use the cache (alsoa few other functions where it was possible without too much fuss, butthese mostly use the translation for logging in case of error, which israre).Link: https://bugzilla.redhat.com/show_bug.cgi?id=1733259Cc: Michal Sekletar Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley Tested-by: Stephen Smalley Reviewed-by: Paul E. McKenney [PM: lots of merge fixups due to collisions with other sidtab patches]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

66f8e2f0 - selinux: sidtab reverse lookup hash table

Fri, 22 Nov 2019 09:33:06 +0000

selinux: sidtab reverse lookup hash tableThis replaces the reverse table lookup and reverse cache with ahashtable which improves cache-miss reverse-lookup times fromO(n) to O(1)* and maintains the same performance as a reversecache hit.This reduces the time needed to add a new sidtab entry from ~500usto 5us on a Pixel 3 when there are ~10,000 sidtab entries.The implementation uses the kernel's generic hashtable API,It uses the context's string represtation as the hash source,and the kernels generic string hashing algorithm full_name_hash()to reduce the string to a 32 bit value.This change also maintains the improvement introduced incommit ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improveperformance") which removed the need to keep the current sidtablocked during policy reload. It does however introduce periodiclocking of the target sidtab while converting the hashtable. Sidtabentries are never modified or removed, so the context struct storedin the sid_to_context tree can also be used for the context_to_sidhashtable to reduce memory usage.This bug was reported by:- On the selinux bug tracker. BUG: kernel softlockup due to too many SIDs/contexts #37 https://github.com/SELinuxProject/selinux-kernel/issues/37- Jovana Knezevic on Android's bugtracker. Bug: 140252993 "During multi-user performance testing, we create and remove users many times. selinux_android_restorecon_pkgdir goes from 1ms to over 20ms after about 200 user creations and removals. Accumulated over ~280 packages, that adds a significant time to user creation, making perf benchmarks unreliable."* Hashtable lookup is only O(1) when n < the number of buckets.Signed-off-by: Jeff Vander Stoep Reported-by: Stephen Smalley Reported-by: Jovana Knezevic Reviewed-by: Stephen Smalley Tested-by: Stephen Smalley [PM: subj tweak, removed changelog from patch description]Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/selinux/Kconfig

be6ec88f - selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE

Tue, 02 Oct 2018 00:08:57 +0000

selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUEIn preparation for removing CONFIG_DEFAULT_SECURITY, this removes thesoon-to-be redundant SECURITY_SELINUX_BOOTPARAM_VALUE. Since explicitordering via CONFIG_LSM or "lsm=" will define whether an LSM is enabled ornot, this CONFIG will become effectively ignored, so remove it. However,in order to stay backward-compatible with "security=selinux", the enablevariable defaults to true.Signed-off-by: Kees Cook List of files: /linux-6.15/security/selinux/Kconfig

dd0859dc - security: introduce CONFIG_SECURITY_WRITABLE_HOOKS

Tue, 14 Feb 2017 13:17:24 +0000

security: introduce CONFIG_SECURITY_WRITABLE_HOOKSSubsequent patches will add RO hardening to LSM hooks, however, SELinuxstill needs to be able to perform runtime disablement after init to handlearchitectures where init-time disablement via boot parameters is not feasible.Introduce a new kernel configuration parameter CONFIG_SECURITY_WRITABLE_HOOKS,and a helper macro __lsm_ro_after_init, to handle this case.Signed-off-by: James Morris Acked-by: Stephen Smalley Acked-by: Casey Schaufler Acked-by: Kees Cook List of files: /linux-6.15/security/selinux/Kconfig

348a0db9 - selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAX

Mon, 15 Aug 2016 19:42:12 +0000

selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAXRemove the SECURITY_SELINUX_POLICYDB_VERSION_MAX Kconfig optionPer: https://github.com/SELinuxProject/selinux/wiki/Kernel-TodoThis was only needed on Fedora 3 and 4 and just causes issues now,so drop it.The MAX and MIN should just be whatever the kernel can support.Signed-off-by: William Roberts Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

2a35d196 - selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default

Wed, 21 Oct 2015 21:44:25 +0000

selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE defaultChange the SELinux checkreqprot default value to 0 so that SELinuxperforms access control checking on the actual memory protectionsused by the kernel and not those requested by the application.Signed-off-by: Paul Moore List of files: /linux-6.15/security/selinux/Kconfig

277d342f - selinux: Deprecate and schedule the removal of the the compat_net functionality

Wed, 31 Dec 2008 17:54:11 +0000

selinux: Deprecate and schedule the removal of the the compat_net functionalityThis patch is the first step towards removing the old "compat_net" code fromthe kernel. Secmark, the "compat_net" replacement was first introduced in2.6.18 (September 2006) and the major Linux distributions with SELinux supporthave transitioned to Secmark so it is time to start deprecating the "compat_net"mechanism. Testing a patched version of 2.6.28-rc6 with the initial release ofFedora Core 5 did not show any problems when running in enforcing mode.This patch adds an entry to the feature-removal-schedule.txt file and removesthe SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT configuration option, forcingSecmark on by default although it can still be disabled at runtime. The patchalso makes the Secmark permission checks "dynamic" in the sense that they areonly executed when Secmark is configured; this should help prevent problemswith older distributions that have not yet migrated to Secmark.Signed-off-by: Paul Moore Acked-by: James Morris List of files: /linux-6.15/security/selinux/Kconfig

f058925b - Update selinux info in MAINTAINERS and Kconfig help text

Thu, 11 Sep 2008 13:20:26 +0000

Update selinux info in MAINTAINERS and Kconfig help textUpdate the SELinux entry in MAINTAINERS and drop the obsolete informationfrom the selinux Kconfig help text.Signed-off-by: Stephen Smalley Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Kconfig

64dbf074 - selinux: introduce permissive types

Mon, 31 Mar 2008 01:17:33 +0000

selinux: introduce permissive typesIntroduce the concept of a permissive type. A new ebitmap is introduced tothe policy database which indicates if a given type has the permissive bitset or not. This bit is tested for the scontext of any denial. The bit ismeaningless on types which only appear as the target of a decision and neverthe source. A domain running with a permissive type will be allowed toperform any action similarly to when the system is globally set permissive.Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Kconfig

3bb56b25 - SELinux: Add a capabilities bitmap to SELinux policy version 22

Tue, 29 Jan 2008 13:38:19 +0000

SELinux: Add a capabilities bitmap to SELinux policy version 22Add a new policy capabilities bitmap to SELinux policy version 22. This bitmapwill enable the security server to query the policy to determine which featuresit supports.Signed-off-by: Paul Moore Signed-off-by: James Morris List of files: /linux-6.15/security/selinux/Kconfig

3dde6ad8 - Fix trivial typos in Kconfig* files

Wed, 09 May 2007 05:12:20 +0000

Fix trivial typos in Kconfig* filesFix several typos in help text in Kconfig* files.Signed-off-by: David Sterba Signed-off-by: Adrian Bunk List of files: /linux-6.15/security/selinux/Kconfig