lkml.org 
[lkml]   [2008]   [Feb]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: SMACK or SELinux, but not both
From
Date

On Tue, 2008-02-26 at 20:28 +1100, James Morris wrote:
> On Tue, 26 Feb 2008, Alexey Dobriyan wrote:
>
> > If SELinux is registered before SMACK, SMACK panics after
> > register_security() call.
> >
> > If SMACK is registered before SELinux, SELinux panics after
> > register_security() call.
> >
> > Consequently allmodconfig kernel doesn't boot. It would be nice if
> > some Kconfig magic to exclude each other will be in place.
>
> People want to be able to select the security model at boot time, so the
> option to build both LSMs is required.
>
> You can stop SELinux from attempting to register as an LSM via selinux=0,
> which should allow you to boot with just Smack enabled.

Ideally, one could just boot with security=<module> to select the
desired primary security module. security=smack, security=selinux, or
security=capability.

Having to specify selinux=0 smack=0 foo=0 just to get bar wouldn't be
pretty. Not that anyone would want to do that, of course...

--
Stephen Smalley
National Security Agency



\
 
 \ /
  Last update: 2008-02-26 13:43    [W:0.153 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site