Messages in this thread |  | | From | Kees Cook <> | Date | Tue, 2 Oct 2018 17:12:58 -0700 | Subject | Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter |
| |
On Tue, Oct 2, 2018 at 5:05 PM, John Johansen <john.johansen@canonical.com> wrote: > On 10/02/2018 04:54 PM, Kees Cook wrote: >> That's not how I have it currently. It's a comma-separated a string, >> including the reserved name "all". The default would just be >> "CONFIG_LSM_ENABLE=all". Casey and I wanted this to have a way to >> capture new LSMs by default at build-time. >> > > I understand where you are coming from, but speaking with my distro > hat on, that is not going to work. As a distro Ubuntu very much wants > to be able to offer all the LSMs built in to the kernel so the user > can select them. But very much wants to be able to specify a default > supported subset that is enabled at boot. > > I expect RH and Suse will feel similarily. Speaking for Ubuntu if this > isn't available as part of lsm stacking it will get distro patched in.
Right. Ubuntu would do something like:
CONFIG_LSM_ENABLE=yama,apparmor,integrity
And that's why I wanted non-explicit lsm.enable, so that an end user could just do:
lsm.enable=loadpin
to add loadpin.
Perhaps we could have both? "lsm.enable=+loadpin" (add loadpin to build default list) vs "lsm.enable=loadpin" (override build default list with ONLY loadpin).
-Kees
-- Kees Cook Pixel Security
|  |