This should address the issue of people tripping over the new secmark
controls when upgrading their kernel before the userland components are
available.
With this patch, the new secmark controls for SElinux are now disabled by
default, so existing behavior is entirely preserved, and the user is not
affected at all.
It also provides a config option to enable the secmark controls by default
(which can always be overridden at boot and runtime). It is also noted in
the kconfig help that the user will need updated userspace if enabling
secmark controls for SELinux and that they'll probably need the SECMARK
and CONNMARK targets, and conntrack protocol helpers, although such
decisions are beyond the scope of kernel configuration.
Please review an apply if ok.
Signed-off-by: James Morris <[EMAIL PROTECTED]>
---
security/selinux/Kconfig | 31 ++++++++++++++++++++++++++++++-
security/selinux/selinuxfs.c | 9 ++++++++-
2 files changed, 38 insertions(+), 2 deletions(-)
diff -purN -X dontdiff linux-2.6.17-rc4-mm2.p/security/selinux/Kconfig
linux-2.6.17-rc4-mm2.w/security/selinux/Kconfig
--- linux-2.6.17-rc4-mm2.p/security/selinux/Kconfig 2006-05-20
19:46:38.000000000 -0400
+++ linux-2.6.17-rc4-mm2.w/security/selinux/Kconfig 2006-05-22
00:06:23.000000000 -0400
@@ -1,6 +1,7 @@
config SECURITY_SELINUX
bool "NSA SELinux Support"
- depends on SECURITY_NETWORK && AUDIT && NET && INET && NETWORK_SECMARK
+ depends on SECURITY_NETWORK && AUDIT && NET && INET
+ select NETWORK_SECMARK
default n
help
This selects NSA Security-Enhanced Linux (SELinux).
@@ -95,3 +96,31 @@ config SECURITY_SELINUX_CHECKREQPROT_VAL
via /selinux/checkreqprot if authorized by policy.
If you are unsure how to answer this question, answer 1.
+
+config SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
+ bool "NSA SELinux enable new secmark network controls by default"
+ depends on SECURITY_SELINUX
+ default n
+ help
+ This option determines whether the new secmark-based network
+ controls will be enabled by default. If not, the old internal
+ per-packet controls will be enabled by default, preserving
+ old behavior.
+
+ If you enable the new controls, you will need updated
+ SELinux userspace libraries, tools and policy. Typically,
+ your distribution will provide these and enable the new controls
+ in the kernel they also distribute.
+
+ Note that this option can be overriden at boot with the
+ selinux_compat_net parameter, and after boot via
+ /selinux/compat_net. See Documentation/kernel-parameters.txt
+ for details on this parameter.
+
+ If you enable the new network controls, you will likely
+ also require the SECMARK and CONNSECMARK targets, as
+ well as any conntrack helpers for protocols which you
+ wish to control.
+
+ If you are unsure what do do here, select N.
+
diff -purN -X dontdiff linux-2.6.17-rc4-mm2.p/security/selinux/selinuxfs.c
linux-2.6.17-rc4-mm2.w/security/selinux/selinuxfs.c
--- linux-2.6.17-rc4-mm2.p/security/selinux/selinuxfs.c 2006-05-20
19:46:38.000000000 -0400
+++ linux-2.6.17-rc4-mm2.w/security/selinux/selinuxfs.c 2006-05-22
00:23:00.000000000 -0400
@@ -37,7 +37,14 @@
#include "conditional.h"
unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
-int selinux_compat_net;
+
+#ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
+#define SELINUX_COMPAT_NET_VALUE 0
+#else
+#define SELINUX_COMPAT_NET_VALUE 1
+#endif
+
+int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;
static int __init checkreqprot_setup(char *str)
{
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
