Re: [RFC PATCH] selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default

[Paul Moore <pmoore@redhat.com>]

On Monday, September 21, 2015 03:34:34 PM Paul Moore wrote:
> Change the SELinux checkreqprot default value to 0 so that SELinux
> performs access control checking on the actual memory protections
> used by the kernel and not those requested by the application.
> 
> Signed-off-by: Paul Moore <pmoore@redhat.com>
> ---
>  security/selinux/Kconfig |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

FYI, I just merged this into selinux#next.

> diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
> index bca1b74..8691e92 100644
> --- a/security/selinux/Kconfig
> +++ b/security/selinux/Kconfig
> @@ -78,7 +78,7 @@ config SECURITY_SELINUX_CHECKREQPROT_VALUE
>  	int "NSA SELinux checkreqprot default value"
>  	depends on SECURITY_SELINUX
>  	range 0 1
> -	default 1
> +	default 0
>  	help
>  	  This option sets the default value for the 'checkreqprot' flag
>  	  that determines whether SELinux checks the protection requested
> @@ -92,7 +92,7 @@ config SECURITY_SELINUX_CHECKREQPROT_VALUE
>  	  'checkreqprot=' boot parameter.  It may also be changed at runtime
>  	  via /selinux/checkreqprot if authorized by policy.
> 
> -	  If you are unsure how to answer this question, answer 1.
> +	  If you are unsure how to answer this question, answer 0.
> 
>  config SECURITY_SELINUX_POLICYDB_VERSION_MAX
>  	bool "NSA SELinux maximum supported policy format version"

-- 
paul moore
security @ redhat