On Thu, Sep 20, 2018 at 5:25 PM, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > On 9/20/2018 9:23 AM, Kees Cook wrote: >> config LSM_ORDER >> string "Default initialization order of builtin LSMs" >> - default "yama,loadpin,integrity" >> + default "yama,loadpin,integrity,selinux,smack,tomoyo,apparmor" > > If I want to compile all the major modules into my kernel and use > AppArmor by default would I use > > default "yama,loadpin,integrity,apparmor,selinux,smack,tomoyo" > > or > > default "yama,loadpin,integrity,apparmor" I was expecting the former, but the latter will have the same result. > When we have "blob-sharing" how could I compile in tomoyo, > but exclude it without a boot line option? Ooh, yes, this series has no way to do that. Perhaps CONFIG_LSM_DISABLE in the same form as CONFIG_LSM_ORDER? I would totally remove LoadPin's CONFIG for this in favor it. > When we have full stacking, how could I compile in selinux > but exclude it? Yup, same problem. Same suggested solution? Should lsm.enable/disable= also become a comma-separated list, or should I leave it as a multi-instance thing like I have it? -Kees -- Kees Cook Pixel Security
