Re: [PATCH v2 1/3] selinux: prune /sys/fs/selinux/checkreqprot

[Paul Moore <paul@paul-moore.com>]

On Apr 29, 2026 Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
> 
> commit a7e4676e8e2cb ("selinux: remove the 'checkreqprot'
> functionality") removed the ability to modify the checkreqprot setting
> but left everything except the updating of the checkreqprot value
> intact. Aside from unnecessary processing, this could produce a local
> DoS from log spam and incorrectly calls selinux_ima_measure_state() on
> each write even though no state has changed. Prune it to just return
> count (i.e. all bytes written successfully) so that userspace never
> breaks.
> 
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
>  security/selinux/selinuxfs.c | 45 ++++--------------------------------
>  1 file changed, 5 insertions(+), 40 deletions(-)
> 
> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
> index 8c107af5140e..71ffa64b15a6 100644
> --- a/security/selinux/selinuxfs.c
> +++ b/security/selinux/selinuxfs.c
> @@ -689,46 +689,11 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
>  static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
>  				      size_t count, loff_t *ppos)
>  {
> -	char *page;
> -	ssize_t length;
> -	unsigned int new_value;
> -
> -	length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
> -			      SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
> -			      NULL);
> -	if (length)
> -		return length;
> -
> -	if (count >= PAGE_SIZE)
> -		return -ENOMEM;
> -
> -	/* No partial writes. */
> -	if (*ppos != 0)
> -		return -EINVAL;
> -
> -	page = memdup_user_nul(buf, count);
> -	if (IS_ERR(page))
> -		return PTR_ERR(page);
> -
> -	if (sscanf(page, "%u", &new_value) != 1) {
> -		length = -EINVAL;
> -		goto out;
> -	}
> -	length = count;
> -
> -	if (new_value) {
> -		char comm[sizeof(current->comm)];
> -
> -		strscpy(comm, current->comm);
> -		pr_err("SELinux: %s (%d) set checkreqprot to 1. This is no longer supported.\n",
> -		       comm, current->pid);
> -	}

I agree with Ondrej's comment that the log spam problem could be resolved
with pr_err_once() while still preserving the notification.  Since it will
only be reported once, you can probably skip the read/parsing/etc. and
just report that checkreqprot is no longer supported:

  static ssize_t swl_write_checkreqprot(...)
  {
    /*
     * Setting ... <deprecation url>
     */
    pr_err_once(...);
    return count;
  }

> -	selinux_ima_measure_state();
> -
> -out:
> -	kfree(page);
> -	return length;
> +	/*
> +	 * Setting checkreqprot is no longer supported, see
> +	 * https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot
> +	 */
> +	return count;
>  }
>  static const struct file_operations sel_checkreqprot_ops = {
>  	.read		= sel_read_checkreqprot,
> -- 
> 2.54.0

--
paul-moore.com