Greg Kroah-Hartman
598cf27219
Link: https://lore.kernel.org/r/20260217200002.683975158@linuxfoundation.org Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Mark Brown <broonie@kernel.org> Tested-by: Luna Jernberg <droidbittin@gmail.com> Tested-by: Ronald Warsow <rwarsow@gmx.de> Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
27 lines
1.4 KiB
Plaintext
27 lines
1.4 KiB
Plaintext
What: /sys/fs/selinux/checkreqprot
|
|
Date: April 2005 (predates git)
|
|
KernelVersion: 2.6.12-rc2 (predates git)
|
|
Contact: selinux@vger.kernel.org
|
|
Description:
|
|
|
|
REMOVAL UPDATE: The SELinux checkreqprot functionality was removed in
|
|
March 2023, the original deprecation notice is shown below.
|
|
|
|
The selinuxfs "checkreqprot" node allows SELinux to be configured
|
|
to check the protection requested by userspace for mmap/mprotect
|
|
calls instead of the actual protection applied by the kernel.
|
|
This was a compatibility mechanism for legacy userspace and
|
|
for the READ_IMPLIES_EXEC personality flag. However, if set to
|
|
1, it weakens security by allowing mappings to be made executable
|
|
without authorization by policy. The default value of checkreqprot
|
|
at boot was changed starting in Linux v4.4 to 0 (i.e. check the
|
|
actual protection), and Android and Linux distributions have been
|
|
explicitly writing a "0" to /sys/fs/selinux/checkreqprot during
|
|
initialization for some time. Support for setting checkreqprot to 1
|
|
will be removed no sooner than June 2021, at which point the kernel
|
|
will always cease using checkreqprot internally and will always
|
|
check the actual protections being applied upon mmap/mprotect calls.
|
|
The checkreqprot selinuxfs node will remain for backward compatibility
|
|
but will discard writes of the "0" value and will reject writes of the
|
|
"1" value when this mechanism is removed.
|