Fedora Core 2 and SELinux

[Bill Nottingham]

Just clarifying what's been posted in a couple of other threads.

SELinux *will* be included in Fedora Core 2 test 3 and the final
Fedora Core 2 release. However, SELinux will be disabled by default.
To install with SELinux support, pass 'selinux' to the installer
on the command line. (Or, configure it appropriately in kickstart).

This was done based on both internal and external testing and feedback
of the current Fedora Core SELinux implementation and policy. At
this point, we feel that it would be potentially damaging to the aims
of both SELinux and Fedora to ship Fedora Core 2 with SELinux
enabled by default.

We're still committed to the integration of SELinux technology,
and we're still working to fix all the bugs we find. Evaluation of
when the right time isto switch it on by default will continue.

What does this mean for those testing with SELinux? Please, continue!
We're still looking to shake out all the issues and make it work.

Thanks,
The Fedora team

[Matthew Miller]

On Tue, Apr 20, 2004 at 06:12:37PM -0400, Bill Nottingham wrote:
>  SELinux *will* be included in Fedora Core 2 test 3 and the final
>  Fedora Core 2 release. However, SELinux will be disabled by default.
>  To install with SELinux support, pass 'selinux' to the installer
>  on the command line. (Or, configure it appropriately in kickstart). 
Disabled, like the current "disabled" in anaconda, or disabled like
"selinux=0"?



-- 
Matthew Miller           mattdm(a)mattdm.org        <http://www.mattdm.org/>
Boston University Linux      ------>                <http://linux.bu.edu/>

[Jeremy Katz]

On Tue, 2004-04-20 at 19:42, Matthew Miller wrote:
>  On Tue, Apr 20, 2004 at 06:12:37PM -0400, Bill Nottingham wrote:
>  > SELinux *will* be included in Fedora Core 2 test 3 and the final
>  > Fedora Core 2 release. However, SELinux will be disabled by default.
>  > To install with SELinux support, pass 'selinux' to the installer
>  > on the command line. (Or, configure it appropriately in kickstart).
>  
>  Disabled, like the current "disabled" in anaconda, or disabled like
>  "selinux=0"? 
Disabled like the current "disabled" in anaconda right now.  Hopefully
Stephen Smalley's patch to allow completely deregistering SELinux hooks
from before policy gets loaded won't get torn apart too badly on lkml;
then we'll do that as well.

Jeremy

[Gene Czarcinski]

On Tuesday 20 April 2004 22:25, Jeremy Katz wrote:
>  On Tue, 2004-04-20 at 19:42, Matthew Miller wrote:
>  > On Tue, Apr 20, 2004 at 06:12:37PM -0400, Bill Nottingham wrote:
>  > > SELinux *will* be included in Fedora Core 2 test 3 and the final
>  > > Fedora Core 2 release. However, SELinux will be disabled by default.
>  > > To install with SELinux support, pass 'selinux' to the installer
>  > > on the command line. (Or, configure it appropriately in kickstart).
>  >
>  > Disabled, like the current "disabled" in anaconda, or disabled like
>  > "selinux=0"?
>
>  Disabled like the current "disabled" in anaconda right now.  Hopefully
>  Stephen Smalley's patch to allow completely deregistering SELinux hooks
>  from before policy gets loaded won't get torn apart too badly on lkml;
>  then we'll do that as well. 
I am unclear on this (anaconda disabled versus selinux=0).  Can someone 
explain?

Gene

[Stephen Smalley]

On Wed, 2004-04-21 at 04:40, Gene Czarcinski wrote:
>  On Tuesday 20 April 2004 22:25, Jeremy Katz wrote:
>  > Disabled like the current "disabled" in anaconda right now.  Hopefully
>  > Stephen Smalley's patch to allow completely deregistering SELinux hooks
>  > from before policy gets loaded won't get torn apart too badly on lkml;
>  > then we'll do that as well.
>  
>  I am unclear on this (anaconda disabled versus selinux=0).  Can someone 
>  explain? 
The selinux=0 boot parameter is handled by the kernel and causes SELinux
to immediately abort initialization, so that it never registers as a
security module with the kernel, never registers its NetFilter hooks,
and never registers the selinuxfs pseudo filesystem (no-selinux for
short).  The boot parameter was introduced by RH to support shipping a
single kernel with SELinux included while still allowing for disabling
of SELinux.  But Jeremy later informed us that kernel boot parameters
are difficult to employ on certain platforms, so RH looked for another
approach that would be more portable across all platforms.

The /etc/sysconfig/selinux disabled setting is handled by /sbin/init and
occurs after SELinux has already performed basic initialization (but
before policy load), and merely causes SELinux to proceed under
permissive mode with no policy loaded (permissive/no-policy for short). 
permissive/no-policy looks very similar to no-selinux in behavior, but
isn't quite identical and still imposes processing overhead on kernel
operations.

To address this problem, we have developed and submitted a kernel patch
for the SELinux module that adds a runtime disable that can be invoked
prior to the initial policy load, so that /sbin/init will be able to
truly disable SELinux, unregistering its security hooks, NetFilter
hooks, and the selinuxfs filesystem.  The patches were posted to lkml
and the NSA selinux mailing list, and are now in 2.6.6-rc2-mm1 and have
been submitted to Linus (but are not yet in bk).  Once a kernel is
released with this support, /sbin/init can be updated to use it.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Dax Kelson]

On Wed, 2004-04-21 at 06:33, Stephen Smalley wrote:
>  To address this problem, we have developed and submitted a kernel
> patch
>  for the SELinux module that adds a runtime disable that can be invoked
>  prior to the initial policy load, so that /sbin/init will be able to
>  truly disable SELinux, unregistering its security hooks, NetFilter
>  hooks, and the selinuxfs filesystem.  The patches were posted to lkml
>  and the NSA selinux mailing list, and are now in 2.6.6-rc2-mm1 and have
>  been submitted to Linus (but are not yet in bk).  Once a kernel is
>  released with this support, /sbin/init can be updated to use it. 
Nine hours ago Linus accepted that patch into his tree.

[Stephen Smalley]

On Wed, 2004-04-21 at 19:31, Dax Kelson wrote:
>  Nine hours ago Linus accepted that patch into his tree. 
Thanks for the heads up.  I've sent a patch to libselinux to Dan to add
a function exporting the runtime disable interface to applications, and
he should then be able to modify init to try using it (and then fall
back to the existing logic if it fails due to an older kernel).

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency