Messages in this thread |  | | Subject | Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter | From | John Johansen <> | Date | Tue, 2 Oct 2018 14:11:03 -0700 |
| |
On 10/02/2018 01:29 PM, Kees Cook wrote: > On Tue, Oct 2, 2018 at 12:47 PM, John Johansen > <john.johansen@canonical.com> wrote: >> On 10/02/2018 12:17 PM, Kees Cook wrote: >>> I could define CONFIG_LSM_ENABLE as being "additive" to >>> SECURITY_APPARMOR_BOOTPARAM_VALUE and >>> SECURITY_SELINUX_BOOTPARAM_VALUE? >> >> Oh sure lets deal with my complaint about too many ways to configure >> this beast by adding yet another config option :P > > This is what v3 already does: SEC...BOOTPARAM_VALUE trumps ...LSM_ENABLE. > sure but I sent in a patch to kill SECURITY_APPARMOR_BOOTPARAM_VALUE because I really dislike the extra levels of config and getting rid of the SEC..BOOTPARAM_VALUE seems to be the easy way to fix it
Now if only we can convince Paul and Stephen :)
>> seriously though, please no. That just adds another layer of confusion >> even if it is only being foisted on the distro/builder > > You've already sent a patch removing > SECURITY_APPARMOR_BOOTPARAM_VALUE. If SELinux is fine to do that too, > then I think we'll be sorted out. I'll just need to make "lsm.enable=" > be an explicit list. (Do you have a problem with "lsm.disable=..." ?) >
why yes, glad you asked
If lsm.enabled is an explicit list lsm.disabled isn't required its a convenience option that can introduce confusion and conflicts. If both lsm.enabled and lsm.disabled are being used at the same time.
I realize that some times the convenience of specifying
lsm.disable=$LSM
is easier than specifying an entire list of what should be enabled when you just want to disable a single LSM.
I don't think the convenience is worth the potential confusion, but I don't feel strongly about it and realize others feel the other way.
tldr: I can live with it, but don't like it if you are asking :)
|  |