I want to enable CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT in the
fedora kernel series. First let me say there are almost no users at all
of the SELinux networking controls at all (old=netif or new=secmark) and
we do provide a flag (/selinux/compat_net) for userspace to turn it back
to the old stuff if a user needs. What few users I do know who use the
network controls run RHEL not fedora. RHEL5 actually shipped with this
enabled. I made that choice namely because there is a performance hit
with the 'old style' network controls and the new secmark controls have
a much smaller penalty. I just can't see a reason to make everyone who
uses Fedora pay a performance hit for network controls which never
enforce any security goal, are probably going to be removed upstream,
and noone uses anyway.
-Eric
--- tmp/config-2.6.23-0.174.rc6.fc8 2007-09-13 00:18:00.000000000 -0400
+++ tmp/config-2.6.23-0.174.rc6.fc8.new 2007-09-13 00:18:39.000000000 -0400
@@ -3330,7 +3330,7 @@ CONFIG_SECURITY_SELINUX_DISABLE=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
-# CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set
+CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=y
# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
CONFIG_XOR_BLOCKS=m
CONFIG_ASYNC_CORE=m
Show replies by date