Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #57417 > unrolled thread

Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE

Started byLaurent Bigonville <bigon@debian.org>
First post2017-04-02 14:50 +0200
Last post2017-04-02 17:50 +0200
Articles 8 — 5 participants

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Laurent Bigonville <bigon@debian.org> - 2017-04-02 14:50 +0200
    Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Ben Hutchings <ben@decadent.org.uk> - 2017-04-02 15:50 +0200
      Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE cgzones <cgzones@googlemail.com> - 2017-04-02 16:50 +0200
        Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Ben Hutchings <ben@decadent.org.uk> - 2017-04-02 21:30 +0200
          Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Christian Göttsche <cgzones@googlemail.com> - 2017-04-11 17:00 +0200
            Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Laurent Bigonville <bigon@debian.org> - 2017-04-11 17:20 +0200
              Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Ben Hutchings <ben@decadent.org.uk> - 2017-04-11 21:40 +0200
      Re: [DSE-Dev] CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE Russell Coker <russell@coker.com.au> - 2017-04-02 17:50 +0200

#57417 — Re: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE

FromLaurent Bigonville <bigon@debian.org>
Date2017-04-02 14:50 +0200
SubjectRe: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE
Message-ID<trN7b-w5-5@gated-at.bofh.it>
Le 02/04/17 à 03:25, cgzones a écrit :
> Is there any reason why the standard Debian kernel sets the value for 
> checkreqprot to 1, while the default[1] is 0?
> RedHat[2] seems also to use 0 and from the documentation 0 seems to be 
> the stricter setting.
>

To be honest I've no idea and the RH bug seems to miss some messages and 
refers to other private bug(s) but I can confirm that on centos 7.3 the 
value is set to 0.

The kernel configuration is done by the kernel team, I'm forwarding your 
question to them on their ML. Maybe they didn't saw the default value 
has changed?

Dear kernel maintainer, do you have an idea about this?

Kind regards,

>
>
> [1] 
> https://github.com/torvalds/linux/commit/2a35d196c160e352fa56eabb7952f78f4c85f577
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=1264977

[toc] | [next] | [standalone]

#57420

FromBen Hutchings <ben@decadent.org.uk>
Date2017-04-02 15:50 +0200
Message-ID<trO3f-16F-13@gated-at.bofh.it>
In reply to#57417

[Multipart message — attachments visible in raw view] — view raw

On Sun, 2017-04-02 at 14:35 +0200, Laurent Bigonville wrote:
> Le 02/04/17 à 03:25, cgzones a écrit :
> > Is there any reason why the standard Debian kernel sets the value for 
> > checkreqprot to 1, while the default[1] is 0?

The default is 1.  The commit changing the default to 0 went into
4.11-rc4, i.e. it is not even in an upstream stable release yet.

> > RedHat[2] seems also to use 0 and from the documentation 0 seems to be 
> > the stricter setting.
> > 
> 
> To be honest I've no idea and the RH bug seems to miss some messages and 
> refers to other private bug(s) but I can confirm that on centos 7.3 the 
> value is set to 0.
> 
> The kernel configuration is done by the kernel team, I'm forwarding your 
> question to them on their ML. Maybe they didn't saw the default value 
> has changed?
> 
> Dear kernel maintainer, do you have an idea about this?

It's been that way in Debian since at least 2005.  So anyone who has a
working SELinux policy for Debian must have taken this behaviour into
account.

Maybe we'll go with the new default for buster.

Ben.

-- 
Ben Hutchings
It is impossible to make anything foolproof because fools are so
ingenious.

[toc] | [prev] | [next] | [standalone]

#57422

Fromcgzones <cgzones@googlemail.com>
Date2017-04-02 16:50 +0200
Message-ID<trOZj-1KM-5@gated-at.bofh.it>
In reply to#57420

[Multipart message — attachments visible in raw view] — view raw

On 2 Apr 2017 3:47 pm, "Ben Hutchings" <ben@decadent.org.uk> wrote:

On Sun, 2017-04-02 at 14:35 +0200, Laurent Bigonville wrote:
> Le 02/04/17 à 03:25, cgzones a écrit :
> > Is there any reason why the standard Debian kernel sets the value for
> > checkreqprot to 1, while the default[1] is 0?

The default is 1.  The commit changing the default to 0 went into
4.11-rc4, i.e. it is not even in an upstream stable release yet.


The change is from Okt 15, 4.4-rc1


> > RedHat[2] seems also to use 0 and from the documentation 0 seems to be
> > the stricter setting.
> >
>
> To be honest I've no idea and the RH bug seems to miss some messages and
> refers to other private bug(s) but I can confirm that on centos 7.3 the
> value is set to 0.
>
> The kernel configuration is done by the kernel team, I'm forwarding your
> question to them on their ML. Maybe they didn't saw the default value
> has changed?
>
> Dear kernel maintainer, do you have an idea about this?

It's been that way in Debian since at least 2005.  So anyone who has a
working SELinux policy for Debian must have taken this behaviour into
account.

Maybe we'll go with the new default for buster.

Ben.

--
Ben Hutchings
It is impossible to make anything foolproof because fools are so
ingenious.

[toc] | [prev] | [next] | [standalone]

#57424

FromBen Hutchings <ben@decadent.org.uk>
Date2017-04-02 21:30 +0200
Message-ID<trTmh-4Gv-7@gated-at.bofh.it>
In reply to#57422

[Multipart message — attachments visible in raw view] — view raw

On Sun, 2017-04-02 at 16:43 +0200, cgzones wrote:
> On 2 Apr 2017 3:47 pm, "Ben Hutchings" <ben@decadent.org.uk> wrote:
> > 
> > On Sun, 2017-04-02 at 14:35 +0200, Laurent Bigonville wrote:
> > > Le 02/04/17 à 03:25, cgzones a écrit :
> > > > Is there any reason why the standard Debian kernel sets the value for
> > > > checkreqprot to 1, while the default[1] is 0?
> > 
> > The default is 1.  The commit changing the default to 0 went into
> > 4.11-rc4, i.e. it is not even in an upstream stable release yet.
> 
> 
> The change is from Okt 15, 4.4-rc1
[...]

You're right; I was confused by the Github web view that you linked to.
(Does anyone know why it shows the latest tag as well as the earliest
tag containing the commit?)

Ben.

-- 
Ben Hutchings
It is impossible to make anything foolproof because fools are so
ingenious.

[toc] | [prev] | [next] | [standalone]

#57516

FromChristian Göttsche <cgzones@googlemail.com>
Date2017-04-11 17:00 +0200
Message-ID<tv5qV-8me-19@gated-at.bofh.it>
In reply to#57424
I am using the boot flag *checkreqprot=0* without any complications or
policy changes.

@Laurent
if you are willing, one could alter the selinux-activate script to set
the boot flag

@Ben
> Maybe we'll go with the new default for buster.
if there are no objections from the Debian SELinux team or users, please do so

[toc] | [prev] | [next] | [standalone]

#57517

FromLaurent Bigonville <bigon@debian.org>
Date2017-04-11 17:20 +0200
Message-ID<tv5Kh-gG-7@gated-at.bofh.it>
In reply to#57516
Le 11/04/17 à 16:53, Christian Göttsche a écrit :
> I am using the boot flag *checkreqprot=0* without any complications or
> policy changes.
>
> @Laurent
> if you are willing, one could alter the selinux-activate script to set
> the boot flag

I think it's too late now to do that (and I don't know all the 
implications).

I prefer that this is changed in the kernel itself TBH

>
> @Ben
>> Maybe we'll go with the new default for buster.
> if there are no objections from the Debian SELinux team or users, please do so

[toc] | [prev] | [next] | [standalone]

#57519

FromBen Hutchings <ben@decadent.org.uk>
Date2017-04-11 21:40 +0200
Message-ID<tv9NU-2Ow-25@gated-at.bofh.it>
In reply to#57517

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2017-04-11 at 17:12 +0200, Laurent Bigonville wrote:
> Le 11/04/17 à 16:53, Christian Göttsche a écrit :
> > I am using the boot flag *checkreqprot=0* without any complications or
> > policy changes.
> > 
> > @Laurent
> > if you are willing, one could alter the selinux-activate script to set
> > the boot flag
> 
> I think it's too late now to do that (and I don't know all the 
> implications).
> 
> I prefer that this is changed in the kernel itself TBH

I looked at this again, and it does seem like we should change this in
now (i.e. for Debian 9) for the sake of security.  Given that it can be
reverted on the kernel command line if necessary, the risk seems quite
low.

Ben.

-- 
Ben Hutchings
73.46% of all statistics are made up.

[toc] | [prev] | [next] | [standalone]

#57423 — Re: [DSE-Dev] CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE

FromRussell Coker <russell@coker.com.au>
Date2017-04-02 17:50 +0200
SubjectRe: [DSE-Dev] CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE
Message-ID<trPVn-2kD-3@gated-at.bofh.it>
In reply to#57420
On Sun, 2 Apr 2017 11:46:59 PM Ben Hutchings wrote:
> > Dear kernel maintainer, do you have an idea about this?
> 
> It's been that way in Debian since at least 2005.  So anyone who has a
> working SELinux policy for Debian must have taken this behaviour into
> account.
> 
> Maybe we'll go with the new default for buster.

Thanks for the quick response.

Changing it for buster seems like a reasonable plan if upstream doesn't change 
anything in the mean time.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web