Skip to contentSkip to conversation

Docs: Update LSM/apparmor.rst

PATCH RESEND In review Siddharth Menon 2 participants 3 messages Oct 2, 2024 – Nov 26, 2024

Subsystems (2)
Documentation Apparmor security module
lore
Share & tools
lore

Siddharth Menon

author
#0 lore raw

PATCH RESEND v2 1/1 Docs: Update LSM/apparmor.rst

After the deprecation of CONFIG_DEFAULT_SECURITY, it is no longer used to enable and configure AppArmor. Since kernel 5.0, CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE is not used either. Instead, the CONFIG_LSM parameter manages the order and selection of LSMs.

Signed-off-by Siddharth Menon <[email protected]>

---
V1 -> V2: Removed historical information and addressed review comments

 Documentation/admin-guide/LSM/apparmor.rst | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
Documentation/admin-guide/LSM/apparmor.rst +5 -2
index 6cf81bbd7ce8..47939ee89d74 100644
@@ -18,8 +18,11 @@ set ``CONFIG_SECURITY_APPARMOR=y``
 
 If AppArmor should be selected as the default security module then set::
 
-   CONFIG_DEFAULT_SECURITY="apparmor"
-   CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+   CONFIG_DEFAULT_SECURITY_APPARMOR=y
+
+The CONFIG_LSM parameter manages the order and selection of LSMs.
+Specify apparmor as the first "major" module (e.g. AppArmor, SELinux, Smack)
+in the list.
 
 Build the kernel
Signature · 1 line
2.39.5
maintainer Acked-by on v2 1/1
#1 lore raw
Quoted 6 lines · Siddharth Menon

After the deprecation of CONFIG_DEFAULT_SECURITY, it is no longer used to enable and configure AppArmor. Since kernel 5.0, CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE is not used either. Instead, the CONFIG_LSM parameter manages the order and selection of LSMs.

Signed-off-by Siddharth Menon <[email protected]>
Acked-by John Johansen <[email protected]>

I have pulled this into my tree

Quoted 23 lines

---
V1 -> V2: Removed historical information and addressed review comments

  Documentation/admin-guide/LSM/apparmor.rst | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)
Documentation/admin-guide/LSM/apparmor.rst +5 -2
index 6cf81bbd7ce8..47939ee89d74 100644
@@ -18,8 +18,11 @@ set ``CONFIG_SECURITY_APPARMOR=y``
 
  If AppArmor should be selected as the default security module then set::
 
-   CONFIG_DEFAULT_SECURITY="apparmor"
-   CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+   CONFIG_DEFAULT_SECURITY_APPARMOR=y
+
+The CONFIG_LSM parameter manages the order and selection of LSMs.
+Specify apparmor as the first "major" module (e.g. AppArmor, SELinux, Smack)
+in the list.
 
  Build the kernel
author
#2 lore raw
Quoted 1 line · John Johansen

I have pulled this into my tree

Thanks for accepting my patch

Regards,
Siddharth Menon