aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorPaul Spooren <mail@aparcar.org>2020-09-01 14:32:45 -1000
committerDaniel Golle <daniel@makrotopia.org>2020-09-03 14:14:33 +0100
commitf922a3e00e0145be9c158de60bef255fe2cb65a1 (patch)
treee7de86e9672f9befd738d7071f2caaba6e9f8e63 /package
parent45a81f70568fc8068866f37147e8b55f131f56cc (diff)
downloadupstream-f922a3e00e0145be9c158de60bef255fe2cb65a1.tar.gz
upstream-f922a3e00e0145be9c158de60bef255fe2cb65a1.tar.bz2
upstream-f922a3e00e0145be9c158de60bef255fe2cb65a1.zip
config: add KERNEL_LSM symbol
The LSM (Linux security mechanism) list is the successor of the now legacy *major LSM*. Instead of defining a single security mechanism the LSM symbol is a comma separated list of mechanisms to load. Until recently OpenWrt would only support DAC (Unix discretionary access controls) which don't require an additional entry in the LSM list. With the newly introduced SELinux support the LSM needs to be extended else only a manual modified Kernel cmdline (`security=selinux`) would activate SELinux. As the default OpenWrt Kernel config sets DAC as default security mechanism, SELinux is stripped from the LSM list, even if `KERNEL_DEFAULT_SECURITY_SELINUX` is activated. To allow SELinux without a modified cmdline this commit sets a specific LSM list if `KERNEL_SECURITY_SELINUX` is enabled. The upstream Kconfig adds even more mechanisms (smack,selinux,tomoyo,apparmor), but until they're ported to OpenWrt, these can be ignored. To compile SELinux Kernel support but disable it from loading, the already present options `KERNEL_SECURITY_SELINUX_DISABLE` or `KERNEL_SECURITY_SELINUX_BOOTPARAM` (with custom cmdline `selinux=0`) can be used. Further it's possible to edit `/etc/selinux/config`. Signed-off-by: Paul Spooren <mail@aparcar.org>
Diffstat (limited to 'package')
0 files changed, 0 insertions, 0 deletions