About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Documentation / security / LSM.txt

Custom Search

Based on kernel version 4.7.2. Page generated on 2016-08-22 22:47 EST.

1	Linux Security Module framework
2	-------------------------------
4	The Linux Security Module (LSM) framework provides a mechanism for
5	various security checks to be hooked by new kernel extensions. The name
6	"module" is a bit of a misnomer since these extensions are not actually
7	loadable kernel modules. Instead, they are selectable at build-time via
8	CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the
9	"security=..." kernel command line argument, in the case where multiple
10	LSMs were built into a given kernel.
12	The primary users of the LSM interface are Mandatory Access Control
13	(MAC) extensions which provide a comprehensive security policy. Examples
14	include SELinux, Smack, Tomoyo, and AppArmor. In addition to the larger
15	MAC extensions, other extensions can be built using the LSM to provide
16	specific changes to system operation when these tweaks are not available
17	in the core functionality of Linux itself.
19	Without a specific LSM built into the kernel, the default LSM will be the
20	Linux capabilities system. Most LSMs choose to extend the capabilities
21	system, building their checks on top of the defined capability hooks.
22	For more details on capabilities, see capabilities(7) in the Linux
23	man-pages project.
25	Based on https://lkml.org/lkml/2007/10/26/215,
26	a new LSM is accepted into the kernel when its intent (a description of
27	what it tries to protect against and in what cases one would expect to
28	use it) has been appropriately documented in Documentation/security/.
29	This allows an LSM's code to be easily compared to its goals, and so
30	that end users and distros can make a more informed decision about which
31	LSMs suit their requirements.
33	For extensive documentation on the available LSM hook interfaces, please
34	see include/linux/security.h.
Hide Line Numbers
About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Information is copyright its respective author. All material is available from the Linux Kernel Source distributed under a GPL License. This page is provided as a free service by mjmwired.net.