Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: prune /sys/fs/selinux/disable

Browse source 
Commit f22f9aaf6c ("selinux: remove the runtime disable
functionality") removed the underlying SELinux runtime disable
functionality but left everything else intact and started logging an
error message to warn any residual users.

Prune it to just log an error message once and to return count
(i.e. all bytes written successfully) to avoid breaking
userspace. This also fixes a local DoS from logspam.

Cc: stable@vger.kernel.org
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Stephen Smalley 2026-05-05 08:49:49 -04:00 • committed by Paul Moore
commit 19cfa00990
1 changed files with 7 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

36
security/selinux/selinuxfs.c
View file

@ -272,35 +272,13 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
char *page; /*
ssize_t length; * Setting disable is no longer supported, see
int new_value; * https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable
*/
if (count >= PAGE_SIZE) pr_err_once("SELinux: %s (%d) wrote to disable. This is no longer supported.\n",
return -ENOMEM; current->comm, current->pid);
return count;
/* No partial writes. */
if (*ppos != 0)
return -EINVAL;
page = memdup_user_nul(buf, count);
if (IS_ERR(page))
return PTR_ERR(page);
if (sscanf(page, "%d", &new_value) != 1) {
length = -EINVAL;
goto out;
}
length = count;
if (new_value) {
pr_err("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable\n");
pr_err("SELinux: Runtime disable is not supported, use selinux=0 on the kernel cmdline.\n");
}
out:
kfree(page);
return length;
} }
static const struct file_operations sel_disable_ops = { static const struct file_operations sel_disable_ops = {