On Wed, Sep 16, 2020 at 04:07:11PM +0200, Ondrej Mosnacek wrote:
On Thu, Sep 10, 2020 at 6:05 PM Robbie Harwood
<rharwood(a)redhat.com> wrote:
>
> Ondrej Mosnacek <omosnace(a)redhat.com> writes:
>
> > James Cassell wrote:
> >> Ben Cotton wrote:
> >>
> >>>
https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime...
> >>>
> >>> == Summary ==
> >>> Remove support for SELinux runtime disable so that the LSM hooks can
> >>> be hardened via read-only-after-initialization protections.
> >>>
> >>> Migrate users to using ''selinux=0'' if they want to
disable SELinux.
> >>
> >> I like the proposal. A few thoughts and questions, though:
> >>
> >> 1. I think systems with SELINUX=disabled without selinux=0 should
> >> hard fail very loudly.
> >
> > That's an interesting opinion... It would be easier and more direct to
> > do it that way, but we are worried that users would complain that
> > their SELINUX=disabled setup is suddenly broken and they need to mess
> > with the bootloader to get a working system again. (I don't know that
> > much about real-time systems, so feel free to correct/enlighten me
> > here.) That's why we try to make sure that things keep working
> > more-or-less the same as before.
>
> Please correct me if I'm wrong, but *aren't* those systems broken? That
> is, if an admin sets selinux=disabled on a system after this change has
> (hypothetically) gone through, won't they have a system in which selinux
> isn't disabled? Or is there going to be migration logic in perpetuity?
I wouldn't say they are broken. They rely on a feature that has been a
supported and kind-of standard way to disable SELinux until now. After
this proposal would be implemented, they would still get a state that
is very close to SELinux being disabled, so I don't think we need to
go as far as e.g. refusing to boot with such configuration.
And btw, even current /etc/selinux/config describes the future situation:
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
^^ this is exactly what will happen when this change is accepted. SELinux will
be enabled internally in kernel but no policy will be loaded and as it was
already explained, for user this situation should be almost the same as SELinux
disabled. The difference will be only in kernel internal level.
Of course, it would be great if we could somehow alert the sysadmin
that they should change their configuration if they have
SELINUX=disabled in /etc/selinux/config but no selinux=0 on kernel
cmdline, but I'm not sure if there is an established way to do that in
Fedora (other than documenting such things in Release notes). On RHEL,
this is possible via LEAPP or Red Hat Insights, but what can you do
on Fedora? Printing warnings/errors anywhere is not reliable, because
the system (or even a cluster of systems) may be managed only remotely
with the admin logging in only when something breaks. Or is there some
established way of telling the admin: "Hey, your system may not seem
broken, but there is this configuration issue that needs your
attention."?
Maybe we could add a oneshot systemd unit which would warn users when
/etc/selinux/config contains SELINUX=disabled but it's not disabled in kernel.
Petr