aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux/selinuxfs.c
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2008-12-31 12:54:11 -0500
committerPaul Moore <paul.moore@hp.com>2008-12-31 12:54:11 -0500
commit277d342fc423fca5e66e677fe629d1b2f8f1b9e2 (patch)
tree733f8694020df6ff8d9e21e2419b0df71aeb4351 /security/selinux/selinuxfs.c
parent6c2e8ac0953fccdd24dc6c4b9e08e8f1cd68cf07 (diff)
downloadmrst-s0i3-test-277d342fc423fca5e66e677fe629d1b2f8f1b9e2.tar.gz
mrst-s0i3-test-277d342fc423fca5e66e677fe629d1b2f8f1b9e2.tar.xz
mrst-s0i3-test-277d342fc423fca5e66e677fe629d1b2f8f1b9e2.zip
selinux: Deprecate and schedule the removal of the the compat_net functionality
This patch is the first step towards removing the old "compat_net" code from the kernel. Secmark, the "compat_net" replacement was first introduced in 2.6.18 (September 2006) and the major Linux distributions with SELinux support have transitioned to Secmark so it is time to start deprecating the "compat_net" mechanism. Testing a patched version of 2.6.28-rc6 with the initial release of Fedora Core 5 did not show any problems when running in enforcing mode. This patch adds an entry to the feature-removal-schedule.txt file and removes the SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT configuration option, forcing Secmark on by default although it can still be disabled at runtime. The patch also makes the Secmark permission checks "dynamic" in the sense that they are only executed when Secmark is configured; this should help prevent problems with older distributions that have not yet migrated to Secmark. Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/selinuxfs.c')
-rw-r--r--security/selinux/selinuxfs.c16
1 files changed, 8 insertions, 8 deletions
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index c8630363823..77fb3c8d926 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -47,13 +47,7 @@ static char *policycap_names[] = {
unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
-#ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
-#define SELINUX_COMPAT_NET_VALUE 0
-#else
-#define SELINUX_COMPAT_NET_VALUE 1
-#endif
-
-int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;
+int selinux_compat_net = 0;
static int __init checkreqprot_setup(char *str)
{
@@ -494,7 +488,13 @@ static ssize_t sel_write_compat_net(struct file *file, const char __user *buf,
if (sscanf(page, "%d", &new_value) != 1)
goto out;
- selinux_compat_net = new_value ? 1 : 0;
+ if (new_value) {
+ printk(KERN_NOTICE
+ "SELinux: compat_net is deprecated, please use secmark"
+ " instead\n");
+ selinux_compat_net = 1;
+ } else
+ selinux_compat_net = 0;
length = count;
out:
free_page((unsigned long) page);