[linux-2.6-block.git] / Documentation / security / LSM.txt

Linux Security Module framework
-------------------------------

The Linux Security Module (LSM) framework provides a mechanism for
various security checks to be hooked by new kernel extensions. The name
"module" is a bit of a misnomer since these extensions are not actually
loadable kernel modules. Instead, they are selectable at build-time via
CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the
"security=..." kernel command line argument, in the case where multiple
LSMs were built into a given kernel.

The primary users of the LSM interface are Mandatory Access Control
(MAC) extensions which provide a comprehensive security policy. Examples
include SELinux, Smack, Tomoyo, and AppArmor. In addition to the larger
MAC extensions, other extensions can be built using the LSM to provide
specific changes to system operation when these tweaks are not available
in the core functionality of Linux itself.

Without a specific LSM built into the kernel, the default LSM will be the
Linux capabilities system. Most LSMs choose to extend the capabilities
system, building their checks on top of the defined capability hooks.
For more details on capabilities, see capabilities(7) in the Linux
man-pages project.

A list of the active security modules can be found by reading
/sys/kernel/security/lsm. This is a comma separated list, and
will always include the capability module. The list reflects the
order in which checks are made. The capability module will always
be first, followed by any "minor" modules (e.g. Yama) and then
the one "major" module (e.g. SELinux) if there is one configured.

Based on https://lkml.org/lkml/2007/10/26/215,
a new LSM is accepted into the kernel when its intent (a description of
what it tries to protect against and in what cases one would expect to
use it) has been appropriately documented in Documentation/security/.
This allows an LSM's code to be easily compared to its goals, and so
that end users and distros can make a more informed decision about which
LSMs suit their requirements.

For extensive documentation on the available LSM hook interfaces, please
see include/linux/security.h.
Commit	Line	Data
e163bc8e KC	1	Linux Security Module framework
	2	-------------------------------
	3
	4	The Linux Security Module (LSM) framework provides a mechanism for
	5	various security checks to be hooked by new kernel extensions. The name
	6	"module" is a bit of a misnomer since these extensions are not actually
	7	loadable kernel modules. Instead, they are selectable at build-time via
	8	CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the
	9	"security=..." kernel command line argument, in the case where multiple
	10	LSMs were built into a given kernel.
	11
	12	The primary users of the LSM interface are Mandatory Access Control
	13	(MAC) extensions which provide a comprehensive security policy. Examples
	14	include SELinux, Smack, Tomoyo, and AppArmor. In addition to the larger
	15	MAC extensions, other extensions can be built using the LSM to provide
	16	specific changes to system operation when these tweaks are not available
	17	in the core functionality of Linux itself.
	18
	19	Without a specific LSM built into the kernel, the default LSM will be the
	20	Linux capabilities system. Most LSMs choose to extend the capabilities
	21	system, building their checks on top of the defined capability hooks.
	22	For more details on capabilities, see capabilities(7) in the Linux
	23	man-pages project.
	24
d69dece5 CS	25	A list of the active security modules can be found by reading
	26	/sys/kernel/security/lsm. This is a comma separated list, and
	27	will always include the capability module. The list reflects the
	28	order in which checks are made. The capability module will always
	29	be first, followed by any "minor" modules (e.g. Yama) and then
	30	the one "major" module (e.g. SELinux) if there is one configured.
	31
591bcb18	32	Based on https://lkml.org/lkml/2007/10/26/215,
e163bc8e KC	33	a new LSM is accepted into the kernel when its intent (a description of
	34	what it tries to protect against and in what cases one would expect to
	35	use it) has been appropriately documented in Documentation/security/.
	36	This allows an LSM's code to be easily compared to its goals, and so
	37	that end users and distros can make a more informed decision about which
	38	LSMs suit their requirements.
	39
	40	For extensive documentation on the available LSM hook interfaces, please
	41	see include/linux/security.h.