From: James Morris <jmorris@redhat.com>

This patch adds an 'selinux' boot parameter which must be used to actually
enable SELinux.

It follows some internal discussion about deployment issues, where a vendor
would want to ship a single kernel image with SELinux built-in, without
requiring the user to use it.

Without specifying selinux=1 as a boot parameter, SELinux will not register
with LSM and selinuxfs will not be registered as a filesystem.  This causes
SELinux to be bypassed entirely from then on, and no performance overhead
is imposed.  Other security modules may then also be loaded if needed.



 25-akpm/security/selinux/Kconfig     |    5 ++++-
 25-akpm/security/selinux/hooks.c     |   14 ++++++++++++++
 25-akpm/security/selinux/selinuxfs.c |    4 +++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff -puN security/selinux/hooks.c~enable-selinux-with-boot-parameter security/selinux/hooks.c
--- 25/security/selinux/hooks.c~enable-selinux-with-boot-parameter	Tue Sep  2 08:41:27 2003
+++ 25-akpm/security/selinux/hooks.c	Tue Sep  2 08:41:27 2003
@@ -73,6 +73,15 @@ static int __init enforcing_setup(char *
 __setup("enforcing=", enforcing_setup);
 #endif
 
+int selinux_enabled = 0;
+
+static int __init selinux_enabled_setup(char *str)
+{
+	selinux_enabled = simple_strtol(str, NULL, 0);
+	return 1;
+}
+__setup("selinux=", selinux_enabled_setup);
+
 /* Original (dummy) security module. */
 static struct security_operations *original_ops = NULL;
 
@@ -3347,6 +3356,11 @@ __init int selinux_init(void)
 {
 	struct task_security_struct *tsec;
 
+	if (!selinux_enabled) {
+		printk(KERN_INFO "SELinux:  Not enabled at boot.\n");
+		return 0;
+	}
+
 	printk(KERN_INFO "SELinux:  Initializing.\n");
 
 	/* Set the security state for the initial task. */
diff -puN security/selinux/Kconfig~enable-selinux-with-boot-parameter security/selinux/Kconfig
--- 25/security/selinux/Kconfig~enable-selinux-with-boot-parameter	Tue Sep  2 08:41:27 2003
+++ 25-akpm/security/selinux/Kconfig	Tue Sep  2 08:41:27 2003
@@ -3,11 +3,14 @@ config SECURITY_SELINUX
 	depends on SECURITY
 	default n
 	help
-	  This enables NSA Security-Enhanced Linux (SELinux).
+	  This selects NSA Security-Enhanced Linux (SELinux).
 	  You will also need a policy configuration and a labeled filesystem.
 	  You can obtain the policy compiler (checkpolicy), the utility for
 	  labeling filesystems (setfiles), and an example policy configuration
 	  from http://www.nsa.gov/selinux.
+	  SELinux needs to be explicitly enabled on the kernel command line with
+	  selinux=1.  If you specify selinux=0 or do not use this parameter,
+	  SELinux will not be enabled.
 	  If you are unsure how to answer this question, answer N.
 
 config SECURITY_SELINUX_DEVELOP
diff -puN security/selinux/selinuxfs.c~enable-selinux-with-boot-parameter security/selinux/selinuxfs.c
--- 25/security/selinux/selinuxfs.c~enable-selinux-with-boot-parameter	Tue Sep  2 08:41:27 2003
+++ 25-akpm/security/selinux/selinuxfs.c	Tue Sep  2 08:41:27 2003
@@ -17,6 +17,8 @@
 #include "security.h"
 #include "objsec.h"
 
+extern int selinux_enabled;
+
 /* Check whether a task is allowed to use a security operation. */
 int task_has_security(struct task_struct *tsk,
 		      u32 perms)
@@ -587,7 +589,7 @@ static struct file_system_type sel_fs_ty
 
 static int __init init_sel_fs(void)
 {
-	return register_filesystem(&sel_fs_type);
+	return selinux_enabled ? register_filesystem(&sel_fs_type) : 0;
 }
 
 __initcall(init_sel_fs);

_