On Fri, 31 Aug 2012 14:31:26 -0700
Kees Cook [off-list ref] wrote:

Unconditionally call Yama, no matter what LSM module is selected.

Ubuntu and Chrome OS already carry patches to do this, and Fedora has
voiced interest in doing this as well. Instead of having everyone carry
these patches, just switch Yama to being unconditional when compiled
into the kernel.

Not a good plan. What happens when everyone decides to stack every module
by ifdeffing in the kernel - mayhem. I'm all for it being possible but
done right - espeicall as I believe a proper proposal now for stacking
modules, and it should be done as part of that.

Alan