[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 6 Jul 2019 08:29:22 -0700
From: Randy Dunlap <rdunlap@...radead.org>
To: Salvatore Mesoraca <s.mesoraca16@...il.com>, linux-kernel@...r.kernel.org
Cc: kernel-hardening@...ts.openwall.com, linux-mm@...ck.org,
linux-security-module@...r.kernel.org,
Alexander Viro <viro@...iv.linux.org.uk>,
Brad Spengler <spender@...ecurity.net>,
Casey Schaufler <casey@...aufler-ca.com>,
Christoph Hellwig <hch@...radead.org>,
James Morris <james.l.morris@...cle.com>, Jann Horn <jannh@...gle.com>,
Kees Cook <keescook@...omium.org>, PaX Team <pageexec@...email.hu>,
"Serge E. Hallyn" <serge@...lyn.com>, Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH v5 02/12] S.A.R.A.: create framework
Hi,
On 7/6/19 3:54 AM, Salvatore Mesoraca wrote:
> diff --git a/security/sara/Kconfig b/security/sara/Kconfig
> new file mode 100644
> index 0000000..0456220
> --- /dev/null
> +++ b/security/sara/Kconfig
> @@ -0,0 +1,40 @@
> +menuconfig SECURITY_SARA
> + bool "S.A.R.A."
> + depends on SECURITY
> + select SECURITYFS
> + default n
No need for "default n". Drop it, please.
> + help
> + This selects S.A.R.A. LSM which aims to collect heterogeneous
> + security measures providing a common interface to manage them.
> + This LSM will always be stacked with the selected primary LSM and
> + other stacked LSMs.
> + Further information can be found in
> + Documentation/admin-guide/LSM/SARA.rst.
> +
> + If unsure, answer N.
> +
> +config SECURITY_SARA_DEFAULT_DISABLED
> + bool "S.A.R.A. will be disabled at boot."
> + depends on SECURITY_SARA
> + default n
> + help
> + If you say Y here, S.A.R.A. will not be enabled at startup. You can
> + override this option at boot time via "sara.enabled=[1|0]" kernel
> + parameter or via user-space utilities.
> + This option is useful for distro kernels.
> +
> + If unsure, answer N.
> +
> +config SECURITY_SARA_NO_RUNTIME_ENABLE
> + bool "S.A.R.A. can be turn on only at boot time."
can be turned on
> + depends on SECURITY_SARA_DEFAULT_DISABLED
> + default y
> + help
> + By enabling this option it won't be possible to turn on S.A.R.A.
> + at runtime via user-space utilities. However it can still be
> + turned on at boot time via the "sara.enabled=1" kernel parameter.
> + This option is functionally equivalent to "sara.enabled=0" kernel
> + parameter. This option is useful for distro kernels.
> +
> + If unsure, answer Y.
> +
--
~Randy
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
