Commit b9b8701b authored by Roberto Sassu's avatar Roberto Sassu Committed by Paul Moore
Browse files

security: Remove integrity from the LSM list in Kconfig 



Remove 'integrity' from the list of LSMs in Kconfig, as it is no longer
necessary. Since the recent change (set order to LSM_ORDER_LAST), the
'integrity' LSM is always enabled (if selected in the kernel
configuration).

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent b7c1ae4b

security/Kconfig

+9 −7
Original line number Diff line number Diff line
@@ -246,15 +246,17 @@ endchoice 


config LSM

	string "Ordered list of enabled LSMs"

	default "landlock,lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK

	default "landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR

	default "landlock,lockdown,yama,loadpin,safesetid,integrity,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO

	default "landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" if DEFAULT_SECURITY_DAC

	default "landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

	default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK

	default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR

	default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO

	default "landlock,lockdown,yama,loadpin,safesetid,bpf" if DEFAULT_SECURITY_DAC

	default "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf"

	help

	  A comma-separated list of LSMs, in initialization order.

	  Any LSMs left off this list will be ignored. This can be

	  controlled at boot with the "lsm=" parameter.

	  Any LSMs left off this list, except for those with order

	  LSM_ORDER_FIRST and LSM_ORDER_LAST, which are always enabled

	  if selected in the kernel configuration, will be ignored.

	  This can be controlled at boot with the "lsm=" parameter.



	  If unsure, leave this as the default.