Linux Security Module Usage¶

The Linux Security Module (LSM) framework provides a mechanism forvarious security checks to be hooked by new kernel extensions. The name“module” is a bit of a misnomer since these extensions are not actuallyloadable kernel modules. Instead, they are selectable at build-time viaCONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the"security=..." kernel command line argument, in the case where multipleLSMs were built into a given kernel.

The primary users of the LSM interface are Mandatory Access Control(MAC) extensions which provide a comprehensive security policy. Examplesinclude SELinux, Smack, Tomoyo, and AppArmor. In addition to the largerMAC extensions, other extensions can be built using the LSM to providespecific changes to system operation when these tweaks are not availablein the core functionality of Linux itself.

The Linux capabilities modules will always be included. This may befollowed by any number of “minor” modules and at most one “major” module.For more details on capabilities, seecapabilities(7) in the Linuxman-pages project.

A list of the active security modules can be found by reading/sys/kernel/security/lsm. This is a comma separated list, andwill always include the capability module. The list reflects theorder in which checks are made. The capability module will alwaysbe first, followed by any “minor” modules (e.g. Yama) and thenthe one “major” module (e.g. SELinux) if there is one configured.

Process attributes associated with “major” security modules shouldbe accessed and maintained using the special files in/proc/.../attr.A security module may maintain a module specific subdirectory there,named after the module./proc/.../attr/smack is provided by the Smacksecurity module and contains all its special files. The files directlyin/proc/.../attr remain as legacy interfaces for modules that providesubdirectories.