27 lines · plain
1What: /sys/fs/selinux/checkreqprot2Date: April 2005 (predates git)3KernelVersion: 2.6.12-rc2 (predates git)4Contact: selinux@vger.kernel.org5Description:6 7 REMOVAL UPDATE: The SELinux checkreqprot functionality was removed in8 March 2023, the original deprecation notice is shown below.9 10 The selinuxfs "checkreqprot" node allows SELinux to be configured11 to check the protection requested by userspace for mmap/mprotect12 calls instead of the actual protection applied by the kernel.13 This was a compatibility mechanism for legacy userspace and14 for the READ_IMPLIES_EXEC personality flag. However, if set to15 1, it weakens security by allowing mappings to be made executable16 without authorization by policy. The default value of checkreqprot17 at boot was changed starting in Linux v4.4 to 0 (i.e. check the18 actual protection), and Android and Linux distributions have been19 explicitly writing a "0" to /sys/fs/selinux/checkreqprot during20 initialization for some time. Support for setting checkreqprot to 121 will be removed no sooner than June 2021, at which point the kernel22 will always cease using checkreqprot internally and will always23 check the actual protections being applied upon mmap/mprotect calls.24 The checkreqprot selinuxfs node will remain for backward compatibility25 but will discard writes of the "0" value and will reject writes of the26 "1" value when this mechanism is removed.27