• Stephen Smalley's avatar
    Documentation,selinux: deprecate setting checkreqprot to 1 · e9c38f9f
    Stephen Smalley authored
    Deprecate setting the SELinux checkreqprot tunable to 1 via kernel
    parameter or /sys/fs/selinux/checkreqprot.  Setting it to 0 is left
    intact for compatibility since Android and some Linux distributions
    do so for security and treat an inability to set it as a fatal error.
    Eventually setting it to 0 will become a no-op and the kernel will
    stop using checkreqprot's value internally altogether.
    
    checkreqprot was originally introduced as a compatibility mechanism
    for legacy userspace and the READ_IMPLIES_EXEC personality flag.
    However, if set to 1, it weakens security by allowing mappings to be
    made executable without authorization by policy.  The default value
    for the SECURITY_SELINUX_CHECKREQPROT_VALUE config option was changed
    from 1 to 0 in commit 2a35d196 ("selinux: change
    CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default") and both Android
    and Linux distributions began explicitly setting
    /sys/fs/selinux/checkreqprot to 0 some time ago.
    Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    e9c38f9f
sysfs-selinux-checkreqprot 1.25 KB