CODEWITHSUNDEEP
linuxsecuritymoduleselinux
Anand Srivastava
Anand Srivastava

Reputation: 71

Can SELinux be loaded after another LSM Module?

I am building an LSM module, which should work with SELinux. It must be registered before SELinux to do the task it needs to do.

Does SELinux fail registration if it is not the first LSM Module to register?

Upvotes: 1

Views: 196

Answers (1)

RandomHash
RandomHash

Reputation: 681

EDIT I realise this is 5 years too late, and the LSM Framework is a moving target. This may not have been correct at the time you posted this, or maybe incorrect in the future

No. SELinux loads last in the module order

Selinux will stack along side any other non-legacy-major LSM(!SMACK SELinux or Apparmor)

Currently Yama is compiled into the kernel by default, which shortens the scope for ptrace operations, Yama is one of the first LSMs to load, yet currently works well with SELinux.

The LSM devs are working on away to remove the exclusivity of certain LSMs and are just about ready to make AppArmor ready for this change.

The end goal is to have the capability of an unlimited amount of LSMs compiled into the kernel, although some work needs to be done before this can be achieved

Upvotes: 2

Related Questions