Re: [PATCH] libselinux: drop legacy probing of /selinux and /proc nodes for selinuxfs

On Tue, Jul 14, 2026 at 10:08 AM James Carter <[email protected]> wrote:
>
> On Tue, Jul 7, 2026 at 11:17 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > Originally selinuxfs was mounted on /selinux before the kernel was
> > change starting in Linux v3.0 to create a mount point directory for it
> > at /sys/fs/selinux, and libselinux had logic to check
> > /proc/filesystems and /proc/mounts for selinuxfs to dynamically detect
> > whether SELinux was enabled and where selinuxfs was mounted if it
> > didn't find selinuxfs in the expected locations. This results in
> > wasted effort on any modern Linux kernel where selinuxfs is always
> > mounted on /sys/fs/selinux, particularly in the SELinux-disabled case.
> >
> > NB This makes Linux v3.0 the minimum supported kernel version for the
> > SELinux userspace going forward.
> >
> > Fixes: https://github.com/SELinuxProject/selinux/issues/468
> > Signed-off-by: Stephen Smalley <[email protected]>
>
> Acked-by: James Carter <[email protected]>
>
Merged.
Thanks,
Jim

> > ---
> >  README.md                    |  4 ++++
> >  libselinux/src/init.c        | 43 ------------------------------------
> >  libselinux/src/load_policy.c |  6 -----
> >  libselinux/src/policy.h      |  3 +--
> >  4 files changed, 5 insertions(+), 51 deletions(-)
> >
> > diff --git a/README.md b/README.md
> > index ea8c4e46..08e82d0c 100644
> > --- a/README.md
> > +++ b/README.md
> > @@ -22,6 +22,10 @@ Archives of the mailing list are available at https://lore.kernel.org/selinux.
> >  See the [SELinux Userspace wiki](https://github.com/SELinuxProject/selinux/wiki)
> >  for more information.
> >
> > +Minimum Supported Kernel Version
> > +--------------------------------
> > +Linux v3.0 (for /sys/fs/selinux mount point directory)
> > +
> >  Installation
> >  ------------
> >
> > diff --git a/libselinux/src/init.c b/libselinux/src/init.c
> > index bd0803dd..1a377a0f 100644
> > --- a/libselinux/src/init.c
> > +++ b/libselinux/src/init.c
> > @@ -81,54 +81,11 @@ int selinuxfs_exists(void)
> >
> >  static void init_selinuxmnt(void)
> >  {
> > -       char *buf = NULL, *p;
> > -       FILE *fp = NULL;
> > -       size_t len;
> > -       ssize_t num;
> > -
> >         if (selinux_mnt)
> >                 return;
> >
> >         if (verify_selinuxmnt(SELINUXMNT) == 0)
> >                 return;
> > -
> > -       if (verify_selinuxmnt(OLDSELINUXMNT) == 0)
> > -               return;
> > -
> > -       /* Drop back to detecting it the long way. */
> > -       if (!selinuxfs_exists())
> > -               goto out;
> > -
> > -       /* At this point, the usual spot doesn't have an selinuxfs so
> > -        * we look around for it */
> > -       fp = fopen("/proc/mounts", "re");
> > -       if (!fp)
> > -               goto out;
> > -
> > -       __fsetlocking(fp, FSETLOCKING_BYCALLER);
> > -       while ((num = getline(&buf, &len, fp)) != -1) {
> > -               char *tmp;
> > -               p = strchr(buf, ' ');
> > -               if (!p)
> > -                       goto out;
> > -               p++;
> > -               tmp = strchr(p, ' ');
> > -               if (!tmp)
> > -                       goto out;
> > -               if (!strncmp(tmp + 1, SELINUXFS " ", strlen(SELINUXFS) + 1)) {
> > -                       *tmp = '\0';
> > -                       break;
> > -               }
> > -       }
> > -
> > -       /* If we found something, dup it */
> > -       if (num > 0)
> > -               verify_selinuxmnt(p);
> > -
> > -out:
> > -       free(buf);
> > -       if (fp)
> > -               fclose(fp);
> >  }
> >
> >  void fini_selinuxmnt(void)
> > diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
> > index 4337cedc..a6ec4a59 100644
> > --- a/libselinux/src/load_policy.c
> > +++ b/libselinux/src/load_policy.c
> > @@ -307,12 +307,6 @@ int selinux_init_load_policy(int *enforce)
> >                   NULL) == 0 ||
> >             errno == EBUSY) {
> >                 mntpoint = SELINUXMNT;
> > -       } else {
> > -               /* check old mountpoint */
> > -               if (mount(SELINUXFS, OLDSELINUXMNT, SELINUXFS, 0, NULL) == 0 ||
> > -                   errno == EBUSY) {
> > -                       mntpoint = OLDSELINUXMNT;
> > -               }
> >         }
> >
> >         if (!mntpoint) {
> > diff --git a/libselinux/src/policy.h b/libselinux/src/policy.h
> > index f6d72423..0ac599a4 100644
> > --- a/libselinux/src/policy.h
> > +++ b/libselinux/src/policy.h
> > @@ -20,9 +20,8 @@
> >  /* selinuxfs magic number */
> >  #define SELINUX_MAGIC 0xf97cff8c
> >
> > -/* Preferred selinux mount location */
> > +/* selinux mount location */
> >  #define SELINUXMNT "/sys/fs/selinux"
> > -#define OLDSELINUXMNT "/selinux"
> >
> >  /* selinuxfs mount point */
> >  extern char *selinux_mnt;
> > --
> > 2.54.0
> >