4 files changed, 23 insertions, 38 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index dc7c681e532c..a0ed3964a219 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -324,3 +324,15 @@ When:	2.6.29 (ideally) or 2.6.30 (more likely)
 Why:    Deprecated by the new (standard) device driver binding model. Use
         i2c_driver->probe() and ->remove() instead.
 Who:    Jean Delvare <khali@linux-fr.org>
+
+---------------------------
+
+What:   SELinux "compat_net" functionality
+When:   2.6.30 at the earliest
+Why:    In 2.6.18 the Secmark concept was introduced to replace the "compat_net"
+        network access control functionality of SELinux.  Secmark offers both
+        better performance and greater flexibility than the "compat_net"
+        mechanism.  Now that the major Linux distributions have moved to
+        Secmark, it is time to deprecate the older mechanism and start the
+        process of removing the old code.
+Who:    Paul Moore <paul.moore@hp.com>
diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
index 26301dd651d3..bca1b74a4a2f 100644
--- a/security/selinux/Kconfig
+++ b/security/selinux/Kconfig
@@ -94,33 +94,6 @@ config SECURITY_SELINUX_CHECKREQPROT_VALUE
 
           If you are unsure how to answer this question, answer 1.
 
-config SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
-        bool "NSA SELinux enable new secmark network controls by default"
-        depends on SECURITY_SELINUX
-        default n
-        help
-          This option determines whether the new secmark-based network
-          controls will be enabled by default.  If not, the old internal
-          per-packet controls will be enabled by default, preserving
-          old behavior.
-
-          If you enable the new controls, you will need updated
-          SELinux userspace libraries, tools and policy.  Typically,
-          your distribution will provide these and enable the new controls
-          in the kernel they also distribute.
-
-          Note that this option can be overridden at boot with the
-          selinux_compat_net parameter, and after boot via
-          /selinux/compat_net.  See Documentation/kernel-parameters.txt
-          for details on this parameter.
-
-          If you enable the new network controls, you will likely
-          also require the SECMARK and CONNSECMARK targets, as
-          well as any conntrack helpers for protocols which you
-          wish to control.
-
-          If you are unsure what to do here, select N.
-
 config SECURITY_SELINUX_POLICYDB_VERSION_MAX
         bool "NSA SELinux maximum supported policy format version"
         depends on SECURITY_SELINUX
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index dbeaa783b2a9..df30a7555d8a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4185,7 +4185,7 @@ static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
                                        u16 family)
 {
-        int err;
+        int err = 0;
         struct sk_security_struct *sksec = sk->sk_security;
         u32 peer_sid;
         u32 sk_sid = sksec->sid;
@@ -4202,7 +4202,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
         if (selinux_compat_net)
                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,
                                                            family, addrp);
-        else
+        else if (selinux_secmark_enabled())
                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
                                    PACKET__RECV, &ad);
         if (err)
@@ -4705,7 +4705,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
                                                          &ad, family, addrp))
                         return NF_DROP;
-        } else {
+        } else if (selinux_secmark_enabled()) {
                 if (avc_has_perm(sksec->sid, skb->secmark,
                                  SECCLASS_PACKET, PACKET__SEND, &ad))
                         return NF_DROP;
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index c86303638235..77fb3c8d9267 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -47,13 +47,7 @@ static char *policycap_names[] = {
 
 unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 
-#ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
-#define SELINUX_COMPAT_NET_VALUE 0
-#else
-#define SELINUX_COMPAT_NET_VALUE 1
-#endif
-
-int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;
+int selinux_compat_net = 0;
 
 static int __init checkreqprot_setup(char *str)
 {
@@ -494,7 +488,13 @@ static ssize_t sel_write_compat_net(struct file *file, const char __user *buf,
         if (sscanf(page, "%d", &new_value) != 1)
                 goto out;
 
-        selinux_compat_net = new_value ? 1 : 0;
+        if (new_value) {
+                printk(KERN_NOTICE
+                       "SELinux: compat_net is deprecated, please use secmark"
+                       " instead\n");
+                selinux_compat_net = 1;
+        } else
+                selinux_compat_net = 0;
         length = count;
 out:
         free_page((unsigned long) page);