LSM: Revive CONFIG_DEFAULT_SECURITY_* for "make oldconfig"
authorKees Cook <>
Fri, 29 Mar 2019 19:36:04 +0000 (12:36 -0700)
committerJames Morris <>
Fri, 29 Mar 2019 21:08:49 +0000 (14:08 -0700)
Commit 70b62c25665f636c ("LoadPin: Initialize as ordered LSM") removed
security/Kconfig and changed CONFIG_LSM to provide a fixed ordering as a
default value. That commit expected that existing users (upgrading from
Linux 5.0 and earlier) will edit CONFIG_LSM value in accordance with
their CONFIG_DEFAULT_SECURITY_* choice in their old kernel configs. But
since users might forget to edit CONFIG_LSM value, this patch revives
the choice (only for providing the default value for CONFIG_LSM) in order
to make sure that CONFIG_LSM reflects CONFIG_DEFAULT_SECURITY_* from their
old kernel configs.

Note that since TOMOYO can be fully stacked against the other legacy
major LSMs, when it is selected, it explicitly disables the other LSMs
to avoid them also initializing since TOMOYO does not expect this

Reported-by: Jakub Kicinski <>
Reported-by: Randy Dunlap <>
Fixes: 70b62c25665f636c ("LoadPin: Initialize as ordered LSM")
Co-developed-by: Tetsuo Handa <>
Signed-off-by: Tetsuo Handa <>
Signed-off-by: Kees Cook <>
Acked-by: Casey Schaufler <>
Signed-off-by: James Morris <>

index 1d6463fb1450c03b8739b102b48b64e05aaa533e..353cfef71d4e9b89f0a71e46748b50dc5ce00c09 100644 (file)
@@ -239,8 +239,46 @@ source "security/safesetid/Kconfig"
 source "security/integrity/Kconfig"
 source "security/integrity/Kconfig"
+       prompt "First legacy 'major LSM' to be initialized"
+       default DEFAULT_SECURITY_DAC
+       help
+         This choice is there only for converting CONFIG_DEFAULT_SECURITY
+         in old kernel configs to CONFIG_LSM in new kernel configs. Don't
+         change this choice unless you are creating a fresh kernel config,
+         for this choice will be ignored after CONFIG_LSM has been set.
+         Selects the legacy "major security module" that will be
+         initialized first. Overridden by non-default CONFIG_LSM.
+               bool "SELinux" if SECURITY_SELINUX=y
+               bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
+               bool "TOMOYO" if SECURITY_TOMOYO=y
+               bool "AppArmor" if SECURITY_APPARMOR=y
+               bool "Unix Discretionary Access Controls"
 config LSM
        string "Ordered list of enabled LSMs"
 config LSM
        string "Ordered list of enabled LSMs"
+       default "yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor" if DEFAULT_SECURITY_SMACK
+       default "yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo" if DEFAULT_SECURITY_APPARMOR
+       default "yama,loadpin,safesetid,integrity,tomoyo" if DEFAULT_SECURITY_TOMOYO
+       default "yama,loadpin,safesetid,integrity" if DEFAULT_SECURITY_DAC
        default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
          A comma-separated list of LSMs, in initialization order.
        default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
          A comma-separated list of LSMs, in initialization order.