Bug 1264977

Summary: BUG: /selinux/checkreqprot should be set to 0 at boot
Product: Red Hat Enterprise Linux 6 Reporter: Paul Moore <pmoore>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED WONTFIX QA Contact: Milos Malik <mmalik>
Severity: high Docs Contact:
Priority: high    
Version: 6.7CC: dwalsh, fweimer, lvrabec, mgrepl, mmalik, plautrba, pmoore, pvrabec, ssekidde
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-10-26 09:51:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1343211    

Description Paul Moore 2015-09-21 19:07:15 UTC
Description of problem:
We should set checkreqprot to 0 at boot to help prevent bypassing SELinux memory protections.  From the kernel Kconfig documentation:

  "This option sets the default value for the 'checkreqprot' flag
   that determines whether SELinux checks the protection requested
   by the application or the protection that will be applied by the
   kernel (including any implied execute for read-implies-exec) for
   mmap and mprotect calls.  If this option is set to 0 (zero),
   SELinux will default to checking the protection that will be applied
   by the kernel.  If this option is set to 1 (one), SELinux will
   default to checking the protection requested by the application."

Additional info:
This change is already present in Fedora.

Comment 1 Paul Moore 2015-09-21 19:08:27 UTC
Related RHEL7 BZ #1264968

Comment 2 Paul Moore 2015-10-29 12:35:05 UTC
Which package version has the fix?

Comment 3 Milos Malik 2015-11-02 12:10:37 UTC
I checked the 3.7.19-281.el6 build, but it doesn't contain the fix.

Comment 4 Paul Moore 2015-11-02 13:11:54 UTC
I'm going to reopen this BZ so we can clear this up; Miroslav, feel free to close this once you've provided the "Fixed in Version" information.

Comment 5 Miroslav Grepl 2015-11-09 14:45:23 UTC
Ok I meant RHEL7.

Comment 9 Simon Sekidde 2016-05-10 16:38:58 UTC
The solution for this would have to be in the spec file like Mirek noted in #c7
I will have to do more testing.

Comment 13 Florian Weimer 2016-10-25 16:36:52 UTC
The way this is set, through patching /etc/rc.local and adding

echo 0 > /selinux/checkreqprot

is really odd.  Is it a good idea to do it this way?

Comment 14 Lukas Vrabec 2016-10-26 09:51:06 UTC
Due to failing of rhbz#1388037 reverting this fix and CLOSING as WONTFIX.