51 lines · plain
1===========================2Linux Security Module Usage3===========================4 5The Linux Security Module (LSM) framework provides a mechanism for6various security checks to be hooked by new kernel extensions. The name7"module" is a bit of a misnomer since these extensions are not actually8loadable kernel modules. Instead, they are selectable at build-time via9CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the10``"security=..."`` kernel command line argument, in the case where multiple11LSMs were built into a given kernel.12 13The primary users of the LSM interface are Mandatory Access Control14(MAC) extensions which provide a comprehensive security policy. Examples15include SELinux, Smack, Tomoyo, and AppArmor. In addition to the larger16MAC extensions, other extensions can be built using the LSM to provide17specific changes to system operation when these tweaks are not available18in the core functionality of Linux itself.19 20The Linux capabilities modules will always be included. This may be21followed by any number of "minor" modules and at most one "major" module.22For more details on capabilities, see ``capabilities(7)`` in the Linux23man-pages project.24 25A list of the active security modules can be found by reading26``/sys/kernel/security/lsm``. This is a comma separated list, and27will always include the capability module. The list reflects the28order in which checks are made. The capability module will always29be first, followed by any "minor" modules (e.g. Yama) and then30the one "major" module (e.g. SELinux) if there is one configured.31 32Process attributes associated with "major" security modules should33be accessed and maintained using the special files in ``/proc/.../attr``.34A security module may maintain a module specific subdirectory there,35named after the module. ``/proc/.../attr/smack`` is provided by the Smack36security module and contains all its special files. The files directly37in ``/proc/.../attr`` remain as legacy interfaces for modules that provide38subdirectories.39 40.. toctree::41 :maxdepth: 142 43 apparmor44 LoadPin45 SELinux46 Smack47 tomoyo48 Yama49 SafeSetID50 ipe51