From Fedora Project Wiki
No edit summary
No edit summary
Line 124: Line 124:
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->


* Make sure kernel is built without CONFIG_SECURITY_SELINUX_DISABLE
* Make sure kernel is built without ''CONFIG_SECURITY_SELINUX_DISABLE''
* Make sure relevant documentation is updated in a way that ''selinux=0'' on kernel command line is preferred way to disable SELinux.
* Make sure relevant documentation is updated in a way that ''selinux=0'' on kernel command line is preferred way to disable SELinux
* Make sure the installer uses kernel command line instead of ''/etc/selinux/config'' to disable SELinux
   
   
* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Line 166: Line 167:
N/A (not a System Wide Change)
N/A (not a System Wide Change)


# Confirm that is disabled when selinux=0 is used on kernel command line
# Confirm that is disabled when ''selinux=0'' is used on kernel command line
# Confirm that userspace consider SELinux disabled when SELINUX=disabled is used in /etc/selinux/config
# Confirm that userspace consider SELinux disabled when ''SELINUX=disabled'' is used in /etc/selinux/config
# Confirm that system works as expected in both previous cases
# Confirm that userspace consider SELinux disabled when there's no ''/etc/selinux/config''
# Confirm that system works as expected in all previous cases


== User Experience ==
== User Experience ==
Line 184: Line 186:
There's no visible change for users with SELinux enabled.
There's no visible change for users with SELinux enabled.


Users with SELINUX=disabled in /etc/selinux/config and without selinux=0 on kernel command line might notice that `ps Z` command uses 'kernel' domain for processes instead of '-'.
Users with ''SELINUX=disabled'' in ''/etc/selinux/config'' and without selinux=0 on kernel command line might notice that `ps Z` command uses ''kernel'' domain for processes instead of '-'.
These users will be also able to load SELinux policy after boot.
These users will be also able to load SELinux policy after boot.


Line 202: Line 204:
* Blocks release? N/A (not a System Wide Change), Yes/No <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Blocks release? N/A (not a System Wide Change), Yes/No <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Blocks product? product <!-- Applicable for Changes that blocks specific product release/Fedora.next -->
* Blocks product? product <!-- Applicable for Changes that blocks specific product release/Fedora.next -->
Revert the kernel build option change and build it with ''CONFIG SECURITY SELINUX DISABLE=y''


== Documentation ==
== Documentation ==
Line 207: Line 211:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
N/A (not a System Wide Change)
TBD


== Release Notes ==
== Release Notes ==
Line 215: Line 219:
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
-->
-->
TBD

Revision as of 09:47, 26 August 2020


Remove support for SELinux runtime disable

Summary

Remove support for SELinux runtime disable so that the LSM hooks can be hardened via read-only-after-initialization protections.

Migrate users to using selinux=0 if they want to disable SELinux.

Owner


Current status

  • Targeted release: Fedora 34
  • Last updated: 2020-08-26
  • FESCo issue: <will be assigned by the Wrangler>
  • Tracker bug: <will be assigned by the Wrangler>
  • Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

Support for SELinux runtime disable via /etc/selinux/config was originally developed to make it easier for Linux distributions to support architectures where adding parameters to the kernel command line was difficult. SELinux runtime disable is enabled via CONFIG_SECURITY_SELINUX_DISABLE kernel build option which was originally developed to make it easier for Linux distributions to support architectures where adding parameters to the kernel command line was difficult. Unfortunately, supporting runtime disable meant we had to make some security trade-offs when it comes to the kernel LSM hooks.

Marking the kernel LSM hooks as read only provides some very nice security benefits, but it does mean that we can no longer disable SELinux at runtime. Toggling between enforcing and permissive mode while booted will remain unaffected and it will still be possible to disable SELinux by adding selinux=0 to the kernel command line via the boot loader (GRUB).

System with SELINUX=disabled in /etc/selinux/config will come up with selinuxfs unmounted, userspace will detect SELinux as disabled. Internally SELinux will be enabled but not initialized so that there will be no SELinux checks applied.

NOTE: Runtime disable is considered deprecated by upstream, and using it will become increasingly painful (e.g. sleeping/blocking) through future kernel releases until eventually it is removed completely. Current kernel reports the following message during runtime disable: SELinux: Runtime disable is deprecated, use selinux=0 on the kernel cmdline

Additional info:

Feedback

Benefit to Fedora

Marking the LSM hooks as read-only provides extra security hardening against certain attacks, e.g. in case an attacker gains ability to write to random kernel memory locations, with support for disable SELinux runtime (CONFIG_SECURITY_SELINUX_DISABLE=y) they have a bigger chance to turn off (parts of) SELinux permission checking.

Scope

  • Proposal owners:
  • Make sure kernel is built without CONFIG_SECURITY_SELINUX_DISABLE
  • Make sure relevant documentation is updated in a way that selinux=0 on kernel command line is preferred way to disable SELinux
  • Make sure the installer uses kernel command line instead of /etc/selinux/config to disable SELinux
  • Other developers: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not a System Wide Change)
  • Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

N/A (not a System Wide Change)

Users should not be directly affected by this change.

How To Test

N/A (not a System Wide Change)

  1. Confirm that is disabled when selinux=0 is used on kernel command line
  2. Confirm that userspace consider SELinux disabled when SELINUX=disabled is used in /etc/selinux/config
  3. Confirm that userspace consider SELinux disabled when there's no /etc/selinux/config
  4. Confirm that system works as expected in all previous cases

User Experience

There's no visible change for users with SELinux enabled.

Users with SELINUX=disabled in /etc/selinux/config and without selinux=0 on kernel command line might notice that ps Z command uses kernel domain for processes instead of '-'. These users will be also able to load SELinux policy after boot.

Dependencies

N/A (not a System Wide Change)

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No
  • Blocks product? product

Revert the kernel build option change and build it with CONFIG SECURITY SELINUX DISABLE=y

Documentation

TBD

Release Notes

TBD

Retrieved from "https://fedoraproject.org/w/index.php?title=SELinux/Changes/Remove_support_for_SELinux_runtime_disable&oldid=586404"