enable CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT

[Eric Paris]

I want to enable CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT in the
fedora kernel series.  First let me say there are almost no users at all
of the SELinux networking controls at all (old=netif or new=secmark) and
we do provide a flag (/selinux/compat_net) for userspace to turn it back
to the old stuff if a user needs.  What few users I do know who use the
network controls run RHEL not fedora.  RHEL5 actually shipped with this
enabled.  I made that choice namely because there is a performance hit
with the 'old style' network controls and the new secmark controls have
a much smaller penalty.  I just can't see a reason to make everyone who
uses Fedora pay a performance hit for network controls which never
enforce any security goal, are probably going to be removed upstream,
and noone uses anyway.

-Eric

--- tmp/config-2.6.23-0.174.rc6.fc8	2007-09-13 00:18:00.000000000 -0400
+++ tmp/config-2.6.23-0.174.rc6.fc8.new	2007-09-13 00:18:39.000000000 -0400
@@ -3330,7 +3330,7 @@ CONFIG_SECURITY_SELINUX_DISABLE=y
 CONFIG_SECURITY_SELINUX_DEVELOP=y
 CONFIG_SECURITY_SELINUX_AVC_STATS=y
 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
-# CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set
+CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=y
 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
 CONFIG_XOR_BLOCKS=m
 CONFIG_ASYNC_CORE=m