Re: [RFC PATCH] selinux: runtime disable is deprecated, add some ssleep() discomfort

From: Paul Moore <paul@paul-moore.com>
To: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Ondrej Mosnacek <omosnace@redhat.com>,
	Petr Lautrbach <plautrba@redhat.com>,
	SElinux list <selinux@vger.kernel.org>
Subject: Re: [RFC PATCH] selinux: runtime disable is deprecated, add some ssleep() discomfort
Date: Wed, 23 Sep 2020 14:32:46 -0400	[thread overview]
Message-ID: <CAHC9VhR4RBT6ZRxbAH13NWTZ0p7UPGiWSZuB_3trVd4qPoVCAQ@mail.gmail.com> (raw)
In-Reply-To: <CAEjxPJ7t4bmmom=ORduFqG5JYkbk+JW1dB4XxLyTULu709=b4A@mail.gmail.com>

On Thu, Sep 10, 2020 at 8:34 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
> On Thu, Sep 10, 2020 at 7:39 AM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> > On Wed, Aug 19, 2020 at 9:07 PM Stephen Smalley
> > <stephen.smalley.work@gmail.com> wrote:
> > > On Wed, Aug 19, 2020 at 1:15 PM Petr Lautrbach <plautrba@redhat.com> wrote:
> > <snip>
> > > > So I've started to compose Fedora Change proposal
> > > >
> > > > https://fedoraproject.org/wiki/SELinux/Changes/Disable_CONFIG_SECURITY_SELINUX_DISABLE
> > > >
> > > > It's not complete yet, but I believe it contains basic information. I'd
> > > > appreciate if you can help me with text, phrases and references so that it would
> > > > be easy to sell it as security feature to Fedora community :)
> > >
> > > I'd simplify the Summary to be something like "Remove support for
> > > SELinux runtime disable so that the LSM hooks can be hardened via
> > > read-only-after-initialization protections.  Migrate users to using
> > > selinux=0 if they want to disable SELinux."
> >
> > FYI, the change proposal has now been announced to the Fedora devel community:
> > https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/YQIYMWKFQEWCILU7UZWXO3YFNS2PLDG4/
>
> Speaking of this, I noticed that Documentation/ABI/README says that
> files under obsolete should say when to expect the interface to be
> removed, and at least a couple of them do, e.g.
> sysfs-class-net-batman-adv:This ABI is deprecated and will be removed
> after 2021.
>
> Should we add similar lines to the two sysfs-selinux-* files, and if
> so, what target date should we propose for each?

Sorry, I overlooked the updates to this thread in my inbox until I saw
the LWN article today and revisited this thread.

The lack of a specific date in the disable sysctl was a deliberate
omission on my part as when the commit was made it wasn't clear when
Fedora would be ready to make the transition.  As we documented in the
the sysfs-selinux-disable obsolescence notice:

  "Fedora is in the process of removing the selinuxfs "disable"
   node and once that is complete we will start the slow process
   of removing this code from the kernel."

As far as the checkreqprot notice is concerned, it probably would be a
good idea to outline a process for its eventual removal.  It isn't
quite the same as the runtime disable issue since the distro work
should all be done at this point, it's just a matter of finally
blocking any "1" writes.  The deprecation made its first appearance in
v5.7, which was released in June 2020, and a year seems like a
reasonable amount of time for this so perhaps we target summer 2021?

-- 
paul moore
www.paul-moore.com