Re: [PATCH] libselinux: fix parsing of the enforcing kernel cmdline parameter

["Rahul Sandhu" <nvraxn@gmail.com>]

Hi Stephen,

> We should make it match the kernel's logic for parsing and handling
> enforcing= on the cmdline. For reference, the kernel does this:
>
> static int __init enforcing_setup(char *str)
> {
>        unsigned long enforcing;
>        if (!kstrtoul(str, 0, &enforcing))
>                selinux_enforcing_boot = enforcing ? 1 : 0;
>        return 1;
> }
> __setup("enforcing=", enforcing_setup);

Okay, seems reasonable, I'll send a v2 to follow that logic shortly.

> And the kernel's parser ignores anything after a "--", passing
> anything after that to the init process.

Just to clarify, unless I'm missing anything I don't see any need for
us to worry about that as:

1. Based on the logic above it would seem 'enforcing=' is recognised by
   the kernel?
2. We're reading /proc/cmdline anyway, so I don't see a reason for that
   to be a concern - we're going to see all arguments as far as I can
   tell.

Although, I'm a bit confused about CONFIG_SECURITY_SELINUX_DEVELOP, how
are we handling that in libselinux? I don't think that stops userspace
from loading in permissive mode, and even with:

#define selinux_enforcing_boot 1

I don't see how that would stop libselinux from loading in permissive.

Regards,
Rahul