lkml.org 
[lkml]   [2008]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC PATCH -mm] LSM: Add lsm= boot parameter

--- Adrian Bunk <bunk@kernel.org> wrote:
> On Sat, Mar 01, 2008 at 12:28:43PM -0800, Casey Schaufler wrote:
> >
> > --- "Ahmed S. Darwish" <darwish.07@gmail.com> wrote:
> >
> > > Hi everybody,
> > >
> > > This is a first try of adding lsm= boot parameter.
> > >
> > > Current situation is:
> > > 1- Ignore wrong input, with a small warning to users.
> > > 2- If user didn't specify a specific module, none will be loaded
> >
> > I'm not fond of this behavior for the case where only one LSM
> > has been built in. Fedora, for example, ought to boot SELinux
> > without specifing lsm=SELinux, and all the rest should boot
> > whatever they are built with. In the case where a kernel is
> > built with conflicting LSMs (today SELinux and Smack) I see
> > this as a useful way to decide which to use until you get
> > your kernel rebuilt sanely, so it appears to be worth having.
> >...
>
> Remarks:
>
> Your comment would be covered if the default for this boot parameter (if
> not explicitely set through the boot loader would not be "disabled" but
> set through kconfig (based on the selected LSMs).

Agreed.

> We should really get this resolved for 2.6.25.

Agreed.

> security= suggestion is IMHO more intuitive than lsm=

security is a very overloaded term, but since this is one
of the ways it's already loaded in I could be OK with that.


Casey Schaufler
casey@schaufler-ca.com


\
 
 \ /
  Last update: 2008-03-01 22:33    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site