Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 504f231c authored by Kees Cook's avatar Kees Cook Committed by Jonathan Corbet
Browse files

doc: ReSTify and split LSM.txt 



The existing LSM.txt file covered both usage and development, so split
this into two files, one under admin-guide and one under kernel
development.

Cc: James Morris <james.l.morris@oracle.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
parent f00f85a8

Documentation/security/LSM.txt→Documentation/admin-guide/LSM/index.rst

+6 −16
Original line number Diff line number Diff line 
Linux Security Module framework

-------------------------------

===========================

Linux Security Module Usage

===========================



The Linux Security Module (LSM) framework provides a mechanism for

various security checks to be hooked by new kernel extensions. The name

"module" is a bit of a misnomer since these extensions are not actually

loadable kernel modules. Instead, they are selectable at build-time via

CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the

"security=..." kernel command line argument, in the case where multiple

``"security=..."`` kernel command line argument, in the case where multiple

LSMs were built into a given kernel.



The primary users of the LSM interface are Mandatory Access Control
@@ -19,23 +20,12 @@ in the core functionality of Linux itself. 
Without a specific LSM built into the kernel, the default LSM will be the

Linux capabilities system. Most LSMs choose to extend the capabilities

system, building their checks on top of the defined capability hooks.

For more details on capabilities, see capabilities(7) in the Linux

For more details on capabilities, see ``capabilities(7)`` in the Linux

man-pages project.



A list of the active security modules can be found by reading

/sys/kernel/security/lsm. This is a comma separated list, and

``/sys/kernel/security/lsm``. This is a comma separated list, and

will always include the capability module. The list reflects the

order in which checks are made. The capability module will always

be first, followed by any "minor" modules (e.g. Yama) and then

the one "major" module (e.g. SELinux) if there is one configured.
 


Based on https://lkml.org/lkml/2007/10/26/215,

a new LSM is accepted into the kernel when its intent (a description of

what it tries to protect against and in what cases one would expect to

use it) has been appropriately documented in Documentation/security/.

This allows an LSM's code to be easily compared to its goals, and so

that end users and distros can make a more informed decision about which

LSMs suit their requirements.



For extensive documentation on the available LSM hook interfaces, please

see include/linux/security.h.

Documentation/admin-guide/index.rst

+1 −0
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ configure specific aspects of kernel behavior to your liking. 
   java

   ras

   pm/index

   LSM/index



.. only::  subproject and html

Documentation/security/00-INDEX

+0 −2
Original line number Diff line number Diff line 
00-INDEX

	- this file.

LSM.txt

	- description of the Linux Security Module framework.

SELinux.txt

	- how to get started with the SELinux security enhancement.

Smack.txt

Documentation/security/LSM.rst

0 → 100644
+14 −0
Original line number Diff line number Diff line 
=================================

Linux Security Module Development

=================================



Based on https://lkml.org/lkml/2007/10/26/215,

a new LSM is accepted into the kernel when its intent (a description of

what it tries to protect against and in what cases one would expect to

use it) has been appropriately documented in ``Documentation/security/LSM``.

This allows an LSM's code to be easily compared to its goals, and so

that end users and distros can make a more informed decision about which

LSMs suit their requirements.



For extensive documentation on the available LSM hook interfaces, please

see ``include/linux/lsm_hooks.h``.

Documentation/security/index.rst

+1 −0
Original line number Diff line number Diff line
@@ -7,5 +7,6 @@ Security Documentation 


   credentials

   IMA-templates

   LSM

   self-protection

   tpm/index