From Fedora Project Wiki
< Changes
(Created page with "{{admon/important | Comments and Explanations | The page source contains comments providing guidance to fill out each section. They are invisible when viewing this page. To re...") |
No edit summary |
||
| Line 1: | Line 1: | ||
<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name. This keeps all change proposals in the same namespace --> | <!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name. This keeps all change proposals in the same namespace --> | ||
| Line 11: | Line 7: | ||
Note that motivation for the change should be in the Benefit to Fedora section below, and this part should answer the question "What?" rather than "Why?". --> | Note that motivation for the change should be in the Benefit to Fedora section below, and this part should answer the question "What?" rather than "Why?". --> | ||
Remove support for SELinux runtime disable so that the LSM hooks can be hardened via read-only-after-initialization protections. | |||
Migrate users to using ''selinux=0'' if they want to disable SELinux. | |||
<!-- | |||
Build kernel without CONFIG_SECURITY_SELINUX_DISABLE, disable writing to a selinuxfs node 'disable' and disable SELinux to be disabled at runtime prior to the policy load. Kernel build without CONFIG_SECURITY_SELINUX_DISABLE can use the '__ro_after_init' kernel hardening feature for security hooks. | Build kernel without CONFIG_SECURITY_SELINUX_DISABLE, disable writing to a selinuxfs node 'disable' and disable SELinux to be disabled at runtime prior to the policy load. Kernel build without CONFIG_SECURITY_SELINUX_DISABLE can use the '__ro_after_init' kernel hardening feature for security hooks. | ||
--> | |||
== Owner == | == Owner == | ||
| Line 61: | Line 63: | ||
<!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | <!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | ||
Support for SELinux runtime disable via ''/etc/selinux/config'' was originally developed to make it easier for Linux distributions to support architectures where adding parameters to the kernel command line was difficult. | |||
Unfortunately, supporting runtime disable meant we had to make some security trade-offs when it | Unfortunately, supporting runtime disable meant we had to make some security trade-offs when it comes to the kernel LSM hooks. | ||
Marking the LSM hooks as read only provides some very nice security benefits, but it does mean that we can no longer disable SELinux at runtime. | Marking the kernel LSM hooks as read only provides some very nice security benefits, but it does mean that we can no longer disable SELinux at runtime. | ||
Toggling between enforcing and permissive mode while booted will remain unaffected and it will still be possible to disable SELinux by adding | Toggling between enforcing and permissive mode while booted will remain unaffected and it will still be possible to disable SELinux by adding '''selinux=0''' to the kernel command line via the boot loader (GRUB). | ||
System with SELINUX=disabled in /etc/selinux/config will come up with selinuxfs unmounted, | System with '''SELINUX=disabled''' in '''/etc/selinux/config''' will come up with selinuxfs unmounted, | ||
userspace will | userspace will detect SELinux as disabled. Internally SELinux will be enabled but not initialized so that there will be no SELinux checks applied. | ||
NOTE: Runtime disable is considered | NOTE: Runtime disable is considered deprecated by upstream, and using it will become increasingly painful (e.g. sleeping/blocking) through future kernel releases until eventually it is removed completely. | ||
Current kernel reports the following message during runtime disable: | Current kernel reports the following message during runtime disable: ''SELinux: Runtime disable is deprecated, use selinux=0 on the kernel cmdline'' | ||
Additional info: | Additional info: | ||
| Line 113: | Line 115: | ||
--> | --> | ||
Marking the LSM hooks as read only provides | Marking the LSM hooks as read-only provides extra security hardening against certain attacks, e.g. in case an attacker gains ability to write to random kernel memory locations, with support for disable SELinux runtime (''CONFIG_SECURITY_SELINUX_DISABLE=y'') they have a bigger chance to turn off (parts of) SELinux permission checking. | ||
== Scope == | == Scope == | ||
* Proposal owners: | * Proposal owners: | ||
<!-- What work do the feature owners have to accomplish to complete the feature in time for release? Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?--> | <!-- What work do the feature owners have to accomplish to complete the feature in time for release? Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?--> | ||
** Make sure kernel is built without ''CONFIG_SECURITY_SELINUX_DISABLE'' | |||
** Make sure relevant documentation is updated in a way that ''selinux=0'' on kernel command line is preferred way to disable SELinux | |||
** Make sure the installer uses kernel command line instead of ''/etc/selinux/config'' to disable SELinux | |||
** Optional: ''selinux'' Ansible module should warn that SELinux needs to be disabled using ''selinux=0'' | |||
** Optional: ''linux-system-roles.selinux'' should disable SELinux using ''selinux=0'' | |||
* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | * Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
| Line 137: | Line 143: | ||
<!-- What happens to systems that have had a previous versions of Fedora installed and are updated to the version containing this change? Will anything require manual configuration or data migration? Will any existing functionality be no longer supported? --> | <!-- What happens to systems that have had a previous versions of Fedora installed and are updated to the version containing this change? Will anything require manual configuration or data migration? Will any existing functionality be no longer supported? --> | ||
Users should not be directly affected by this change. | |||
Users should not directly affected by this change. | |||
== How To Test == | == How To Test == | ||
| Line 160: | Line 163: | ||
N/A (not a System Wide Change) | N/A (not a System Wide Change) | ||
# Confirm that is disabled when selinux=0 is used on kernel command line | # Install kernel built without ''CONFIG_SECURITY_SELINUX_DISABLE'', e.g. from https://copr.fedorainfracloud.org/coprs/omos/drop-selinux-disable/ | ||
# Confirm that userspace consider SELinux disabled when SELINUX=disabled is used in /etc/selinux/config | # Confirm that is disabled when ''selinux=0'' is used on kernel command line | ||
# Confirm that system works as expected in | # Confirm that userspace consider SELinux disabled when ''SELINUX=disabled'' is used in ''/etc/selinux/config'' | ||
# Confirm that userspace consider SELinux disabled when there's no ''/etc/selinux/config'' | |||
# Confirm that system works as expected in all previous cases | |||
== User Experience == | == User Experience == | ||
| Line 178: | Line 183: | ||
There's no visible change for users with SELinux enabled. | There's no visible change for users with SELinux enabled. | ||
Users with SELINUX=disabled in /etc/selinux/config and without selinux=0 on kernel command line might notice that `ps Z` command uses 'kernel' domain for processes | Users with ''SELINUX=disabled'' in ''/etc/selinux/config'' and without ''selinux=0'' on kernel command line might notice that `ps Z` command uses ''kernel'' domain for processes, while with ''selinux=0'' `ps Z` prints '-'. | ||
These users will be | These users will also be able to load SELinux policy after boot. | ||
== Dependencies == | == Dependencies == | ||
| Line 190: | Line 195: | ||
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "Revert the shipped configuration". Or it might not (e.g. rebuilding a number of dependent packages). If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | <!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "Revert the shipped configuration". Or it might not (e.g. rebuilding a number of dependent packages). If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | ||
* Contingency mechanism: | * Contingency mechanism: Revert the kernel build option change and build kernel with ''CONFIG_SECURITY_SELINUX_DISABLE=y'' | ||
<!-- When is the last time the contingency mechanism can be put in place? This will typically be the beta freeze. --> | <!-- When is the last time the contingency mechanism can be put in place? This will typically be the beta freeze. --> | ||
* Contingency deadline: | * Contingency deadline: Beta freeze | ||
<!-- Does finishing this feature block the release, or can we ship with the feature in incomplete state? --> | <!-- Does finishing this feature block the release, or can we ship with the feature in incomplete state? --> | ||
* Blocks release? | * Blocks release? No | ||
* Blocks product? product | <!-- * Blocks product? product Applicable for Changes that blocks specific product release/Fedora.next --> | ||
== Documentation == | == Documentation == | ||
| Line 201: | Line 206: | ||
<!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
TBD | |||
== Release Notes == | == Release Notes == | ||
| Line 209: | Line 214: | ||
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze. | Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze. | ||
--> | --> | ||
TBD | |||
Revision as of 09:27, 27 August 2020
Disable CONFIG_SECURITY_SELINUX_DISABLE
Summary
Remove support for SELinux runtime disable so that the LSM hooks can be hardened via read-only-after-initialization protections.
Migrate users to using selinux=0 if they want to disable SELinux.
Owner
- Name: Petr Lautrbach
- Email: plautrba@redhat.com
- Name: Ondrej Mosnacek
- Email: omosnace@redhat.com
Current status
- Targeted release: Fedora 34
- Last updated: 2020-08-27
- FESCo issue: <will be assigned by the Wrangler>
- Tracker bug: <will be assigned by the Wrangler>
- Release notes tracker: <will be assigned by the Wrangler>
Detailed Description
Support for SELinux runtime disable via /etc/selinux/config was originally developed to make it easier for Linux distributions to support architectures where adding parameters to the kernel command line was difficult. Unfortunately, supporting runtime disable meant we had to make some security trade-offs when it comes to the kernel LSM hooks.
Marking the kernel LSM hooks as read only provides some very nice security benefits, but it does mean that we can no longer disable SELinux at runtime. Toggling between enforcing and permissive mode while booted will remain unaffected and it will still be possible to disable SELinux by adding selinux=0 to the kernel command line via the boot loader (GRUB).
System with SELINUX=disabled in /etc/selinux/config will come up with selinuxfs unmounted, userspace will detect SELinux as disabled. Internally SELinux will be enabled but not initialized so that there will be no SELinux checks applied.
NOTE: Runtime disable is considered deprecated by upstream, and using it will become increasingly painful (e.g. sleeping/blocking) through future kernel releases until eventually it is removed completely. Current kernel reports the following message during runtime disable: SELinux: Runtime disable is deprecated, use selinux=0 on the kernel cmdline
Additional info:
- https://lwn.net/Articles/666550
- https://lore.kernel.org/selinux/159110207843.57260.5661475689740939480.stgit@chester/
- https://lore.kernel.org/selinux/157836784986.560897.13893922675143903084.stgit@chester/#t
Feedback
Benefit to Fedora
Marking the LSM hooks as read-only provides extra security hardening against certain attacks, e.g. in case an attacker gains ability to write to random kernel memory locations, with support for disable SELinux runtime (CONFIG_SECURITY_SELINUX_DISABLE=y) they have a bigger chance to turn off (parts of) SELinux permission checking.
Scope
- Proposal owners:
- Make sure kernel is built without CONFIG_SECURITY_SELINUX_DISABLE
- Make sure relevant documentation is updated in a way that selinux=0 on kernel command line is preferred way to disable SELinux
- Make sure the installer uses kernel command line instead of /etc/selinux/config to disable SELinux
- Optional: selinux Ansible module should warn that SELinux needs to be disabled using selinux=0
- Optional: linux-system-roles.selinux should disable SELinux using selinux=0
- Other developers: N/A (not a System Wide Change)
- Release engineering: #Releng issue number (a check of an impact with Release Engineering is needed)
- Policies and guidelines: N/A (not a System Wide Change)
- Trademark approval: N/A (not needed for this Change)
Upgrade/compatibility impact
Users should not be directly affected by this change.
How To Test
N/A (not a System Wide Change)
- Install kernel built without CONFIG_SECURITY_SELINUX_DISABLE, e.g. from https://copr.fedorainfracloud.org/coprs/omos/drop-selinux-disable/
- Confirm that is disabled when selinux=0 is used on kernel command line
- Confirm that userspace consider SELinux disabled when SELINUX=disabled is used in /etc/selinux/config
- Confirm that userspace consider SELinux disabled when there's no /etc/selinux/config
- Confirm that system works as expected in all previous cases
User Experience
There's no visible change for users with SELinux enabled.
Users with SELINUX=disabled in /etc/selinux/config and without selinux=0 on kernel command line might notice that ps Z command uses kernel domain for processes, while with selinux=0 ps Z prints '-'.
These users will also be able to load SELinux policy after boot.
Dependencies
N/A (not a System Wide Change)
Contingency Plan
- Contingency mechanism: Revert the kernel build option change and build kernel with CONFIG_SECURITY_SELINUX_DISABLE=y
- Contingency deadline: Beta freeze
- Blocks release? No
Documentation
TBD
Release Notes
TBD