Re: [PATCH] LSM: Ignore "security=" when "lsm=" is specified
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: 2019-02-12 00:21:48
Also in:
lkml
Subsystem:
security subsystem, the rest · Maintainers:
Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Kees Cook wrote:
To avoid potential confusion, explicitly ignore "security=" when "lsm=" is used on the command line, and report that it is happening.
To maintain the existing behavior of CONFIG_DEFAULT_SECURITY, I also suggest this change. This saves e.g. Ubuntu users who are using only AppArmor from explicitly specifying security=apparmor when they don't want to enable other LSM_FLAG_LEGACY_MAJOR modules. --- security/Kconfig | 37 +++++++++++++++++++++++++++++++++++++ security/security.c | 5 ++++- 2 files changed, 41 insertions(+), 1 deletion(-)
diff --git a/security/Kconfig b/security/Kconfig
index 9555f49..6a40995 100644
--- a/security/Kconfig
+++ b/security/Kconfig@@ -250,5 +250,42 @@ config LSM If unsure, leave this as the default. +choice + prompt "Default exclusive security module" + default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX + default DEFAULT_SECURITY_SMACK if SECURITY_SMACK + default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO + default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR + default DEFAULT_SECURITY_DAC + + help + The security module where only one of these modules should be enabled if + neither the "security=" parameter nor the "lsm=" parameter is specified. + + config DEFAULT_SECURITY_SELINUX + bool "SELinux" if SECURITY_SELINUX=y + + config DEFAULT_SECURITY_SMACK + bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y + + config DEFAULT_SECURITY_TOMOYO + bool "TOMOYO" if SECURITY_TOMOYO=y + + config DEFAULT_SECURITY_APPARMOR + bool "AppArmor" if SECURITY_APPARMOR=y + + config DEFAULT_SECURITY_DAC + bool "Unix Discretionary Access Controls" + +endchoice + +config DEFAULT_SECURITY + string + default "selinux" if DEFAULT_SECURITY_SELINUX + default "smack" if DEFAULT_SECURITY_SMACK + default "tomoyo" if DEFAULT_SECURITY_TOMOYO + default "apparmor" if DEFAULT_SECURITY_APPARMOR + default "" if DEFAULT_SECURITY_DAC + endmenu
diff --git a/security/security.c b/security/security.c
index e6153ed..c44e3cd 100644
--- a/security/security.c
+++ b/security/security.c@@ -294,8 +294,11 @@ static void __init ordered_lsm_init(void) chosen_major_lsm = NULL; } ordered_lsm_parse(chosen_lsm_order, "cmdline"); - } else + } else { + if (!chosen_major_lsm) + chosen_major_lsm = CONFIG_DEFAULT_SECURITY; ordered_lsm_parse(builtin_lsm_order, "builtin"); + } for (lsm = ordered_lsms; *lsm; lsm++) prepare_lsm(*lsm);
--
1.8.3.1