Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

> turns it off for the whole system when you install WINE.  This patch
> doesn't change that fact.  All it does is add that requirement to
> SELinux systems that already exists on non-selinux systems.

Prior to this an SELinux system could implement sensible security. The
fact Fedora didn't was paranoia and fear over a bad experience made what
five years ago ?

> > Am I missing something here, this "solution" sounds completely brain
> > dead ?
> 
> Well, with patch 2/2 you still get your SELinux protections (only for 1
> page) even if you disable it for the whole system.  So in the end, you
> have better protection than you have today with this series....

We know one page isn't sufficient. That has been seen from some exploit
cases.

So this looks to me like a regression in features, that makes the system
less secure and doesn't solve anything at all.

Whereas if you just set the default SELinux user confinement to allow
everything but mapping low pages you wouldn't actually need to mess up
the kernel ?

Currently I have low page protection and I don't have to run wine as
CAP_SYS_RAWIO (which comes in the "sucidial ideas") category. I consider
the loss of that ability a regression.

Alan