torvalds/linux

What:        /sys/fs/selinux/checkreqprot
Date:        April 2005 (predates git)
KernelVersion:    2.6.12-rc2 (predates git)
Contact:    selinux@vger.kernel.org
Description:

    REMOVAL UPDATE: The SELinux checkreqprot functionality was removed in
    March 2023, the original deprecation notice is shown below.

    The selinuxfs "checkreqprot" node allows SELinux to be configured
    to check the protection requested by userspace for mmap/mprotect
    calls instead of the actual protection applied by the kernel.
    This was a compatibility mechanism for legacy userspace and
    for the READ_IMPLIES_EXEC personality flag.  However, if set to
    1, it weakens security by allowing mappings to be made executable
    without authorization by policy.  The default value of checkreqprot
    at boot was changed starting in Linux v4.4 to 0 (i.e. check the
    actual protection), and Android and Linux distributions have been
    explicitly writing a "0" to /sys/fs/selinux/checkreqprot during
    initialization for some time.  Support for setting checkreqprot to 1
    will be    removed no sooner than June 2021, at which point the kernel
    will always cease using checkreqprot internally and will always
    check the actual protections being applied upon mmap/mprotect calls.
    The checkreqprot selinuxfs node will remain for backward compatibility
    but will discard writes of the "0" value and will reject writes of the
    "1" value when this mechanism is removed.