Messages in this thread |  | | | Date | Sat, 1 Mar 2008 13:29:53 -0800 (PST) | | From | Casey Schaufler <> | | Subject | Re: [RFC PATCH -mm] LSM: Add lsm= boot parameter |
| |
--- Adrian Bunk <bunk@kernel.org> wrote: > On Sat, Mar 01, 2008 at 12:28:43PM -0800, Casey Schaufler wrote: > > > > --- "Ahmed S. Darwish" <darwish.07@gmail.com> wrote: > > > > > Hi everybody, > > > > > > This is a first try of adding lsm= boot parameter. > > > > > > Current situation is: > > > 1- Ignore wrong input, with a small warning to users. > > > 2- If user didn't specify a specific module, none will be loaded > > > > I'm not fond of this behavior for the case where only one LSM > > has been built in. Fedora, for example, ought to boot SELinux > > without specifing lsm=SELinux, and all the rest should boot > > whatever they are built with. In the case where a kernel is > > built with conflicting LSMs (today SELinux and Smack) I see > > this as a useful way to decide which to use until you get > > your kernel rebuilt sanely, so it appears to be worth having. > >... > > Remarks: > > Your comment would be covered if the default for this boot parameter (if > not explicitely set through the boot loader would not be "disabled" but > set through kconfig (based on the selected LSMs).
Agreed.
> We should really get this resolved for 2.6.25.
Agreed.
> security= suggestion is IMHO more intuitive than lsm=
security is a very overloaded term, but since this is one of the ways it's already loaded in I could be OK with that.
Casey Schaufler casey@schaufler-ca.com
|  |