0001 ===========================
0002 Linux Security Module Usage
0003 ===========================
0004
0005 The Linux Security Module (LSM) framework provides a mechanism for
0006 various security checks to be hooked by new kernel extensions. The name
0007 "module" is a bit of a misnomer since these extensions are not actually
0008 loadable kernel modules. Instead, they are selectable at build-time via
0009 CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the
0010 ``"security=..."`` kernel command line argument, in the case where multiple
0011 LSMs were built into a given kernel.
0012
0013 The primary users of the LSM interface are Mandatory Access Control
0014 (MAC) extensions which provide a comprehensive security policy. Examples
0015 include SELinux, Smack, Tomoyo, and AppArmor. In addition to the larger
0016 MAC extensions, other extensions can be built using the LSM to provide
0017 specific changes to system operation when these tweaks are not available
0018 in the core functionality of Linux itself.
0019
0020 The Linux capabilities modules will always be included. This may be
0021 followed by any number of "minor" modules and at most one "major" module.
0022 For more details on capabilities, see ``capabilities(7)`` in the Linux
0023 man-pages project.
0024
0025 A list of the active security modules can be found by reading
0026 ``/sys/kernel/security/lsm``. This is a comma separated list, and
0027 will always include the capability module. The list reflects the
0028 order in which checks are made. The capability module will always
0029 be first, followed by any "minor" modules (e.g. Yama) and then
0030 the one "major" module (e.g. SELinux) if there is one configured.
0031
0032 Process attributes associated with "major" security modules should
0033 be accessed and maintained using the special files in ``/proc/.../attr``.
0034 A security module may maintain a module specific subdirectory there,
0035 named after the module. ``/proc/.../attr/smack`` is provided by the Smack
0036 security module and contains all its special files. The files directly
0037 in ``/proc/.../attr`` remain as legacy interfaces for modules that provide
0038 subdirectories.
0039
0040 .. toctree::
0041 :maxdepth: 1
0042
0043 apparmor
0044 LoadPin
0045 SELinux
0046 Smack
0047 tomoyo
0048 Yama
0049 SafeSetID
