From e9c38f9fc2ccd31befe1bb1605b69213483a15b7 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Wed, 8 Jan 2020 11:24:47 -0500 Subject: Documentation,selinux: deprecate setting checkreqprot to 1 Deprecate setting the SELinux checkreqprot tunable to 1 via kernel parameter or /sys/fs/selinux/checkreqprot. Setting it to 0 is left intact for compatibility since Android and some Linux distributions do so for security and treat an inability to set it as a fatal error. Eventually setting it to 0 will become a no-op and the kernel will stop using checkreqprot's value internally altogether. checkreqprot was originally introduced as a compatibility mechanism for legacy userspace and the READ_IMPLIES_EXEC personality flag. However, if set to 1, it weakens security by allowing mappings to be made executable without authorization by policy. The default value for the SECURITY_SELINUX_CHECKREQPROT_VALUE config option was changed from 1 to 0 in commit 2a35d196c160e3 ("selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default") and both Android and Linux distributions began explicitly setting /sys/fs/selinux/checkreqprot to 0 some time ago. Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) (limited to 'MAINTAINERS') diff --git a/MAINTAINERS b/MAINTAINERS index 38fe2f3f7b6f..0b370797e8a6 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -14986,6 +14986,7 @@ F: security/selinux/ F: scripts/selinux/ F: Documentation/admin-guide/LSM/SELinux.rst F: Documentation/ABI/obsolete/sysfs-selinux-disable +F: Documentation/ABI/obsolete/sysfs-selinux-checkreqprot SENSABLE PHANTOM M: Jiri Slaby -- cgit v1.2.3 From 27978872179b815105082902b22c516359576673 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Wed, 11 Mar 2020 16:05:51 -0400 Subject: MAINTAINERS: Update my email address Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'MAINTAINERS') diff --git a/MAINTAINERS b/MAINTAINERS index 0b370797e8a6..e343b2c75fbc 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -14974,7 +14974,7 @@ X: security/selinux/ SELINUX SECURITY MODULE M: Paul Moore -M: Stephen Smalley +M: Stephen Smalley M: Eric Paris L: selinux@vger.kernel.org W: https://selinuxproject.org -- cgit v1.2.3