Re: [PATCH] LSM: Ignore "security=" when "lsm=" is specified
From: Kees Cook <hidden>
Date: 2019-02-12 00:26:19
Also in:
lkml
On Mon, Feb 11, 2019 at 4:21 PM Tetsuo Handa [off-list ref] wrote:
Kees Cook wrote:quoted
To avoid potential confusion, explicitly ignore "security=" when "lsm=" is used on the command line, and report that it is happening.To maintain the existing behavior of CONFIG_DEFAULT_SECURITY, I also suggest this change. This saves e.g. Ubuntu users who are using only AppArmor from explicitly specifying security=apparmor when they don't want to enable other LSM_FLAG_LEGACY_MAJOR modules.
No, this completely disables the purpose of lsm= I don't understand the use-case you're concerned about? -Kees
quoted hunk ↗ jump to hunk
--- security/Kconfig | 37 +++++++++++++++++++++++++++++++++++++ security/security.c | 5 ++++- 2 files changed, 41 insertions(+), 1 deletion(-)diff --git a/security/Kconfig b/security/Kconfig index 9555f49..6a40995 100644 --- a/security/Kconfig +++ b/security/Kconfig@@ -250,5 +250,42 @@ config LSM If unsure, leave this as the default. +choice + prompt "Default exclusive security module" + default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX + default DEFAULT_SECURITY_SMACK if SECURITY_SMACK + default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO + default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR + default DEFAULT_SECURITY_DAC + + help + The security module where only one of these modules should be enabled if + neither the "security=" parameter nor the "lsm=" parameter is specified. + + config DEFAULT_SECURITY_SELINUX + bool "SELinux" if SECURITY_SELINUX=y + + config DEFAULT_SECURITY_SMACK + bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y + + config DEFAULT_SECURITY_TOMOYO + bool "TOMOYO" if SECURITY_TOMOYO=y + + config DEFAULT_SECURITY_APPARMOR + bool "AppArmor" if SECURITY_APPARMOR=y + + config DEFAULT_SECURITY_DAC + bool "Unix Discretionary Access Controls" + +endchoice + +config DEFAULT_SECURITY + string + default "selinux" if DEFAULT_SECURITY_SELINUX + default "smack" if DEFAULT_SECURITY_SMACK + default "tomoyo" if DEFAULT_SECURITY_TOMOYO + default "apparmor" if DEFAULT_SECURITY_APPARMOR + default "" if DEFAULT_SECURITY_DAC + endmenudiff --git a/security/security.c b/security/security.c index e6153ed..c44e3cd 100644 --- a/security/security.c +++ b/security/security.c@@ -294,8 +294,11 @@ static void __init ordered_lsm_init(void) chosen_major_lsm = NULL; } ordered_lsm_parse(chosen_lsm_order, "cmdline"); - } else + } else { + if (!chosen_major_lsm) + chosen_major_lsm = CONFIG_DEFAULT_SECURITY; ordered_lsm_parse(builtin_lsm_order, "builtin"); + } for (lsm = ordered_lsms; *lsm; lsm++) prepare_lsm(*lsm); --1.8.3.1
-- Kees Cook