.. | .. |
---|
17 | 17 | specific changes to system operation when these tweaks are not available |
---|
18 | 18 | in the core functionality of Linux itself. |
---|
19 | 19 | |
---|
20 | | -Without a specific LSM built into the kernel, the default LSM will be the |
---|
21 | | -Linux capabilities system. Most LSMs choose to extend the capabilities |
---|
22 | | -system, building their checks on top of the defined capability hooks. |
---|
| 20 | +The Linux capabilities modules will always be included. This may be |
---|
| 21 | +followed by any number of "minor" modules and at most one "major" module. |
---|
23 | 22 | For more details on capabilities, see ``capabilities(7)`` in the Linux |
---|
24 | 23 | man-pages project. |
---|
25 | 24 | |
---|
.. | .. |
---|
30 | 29 | be first, followed by any "minor" modules (e.g. Yama) and then |
---|
31 | 30 | the one "major" module (e.g. SELinux) if there is one configured. |
---|
32 | 31 | |
---|
| 32 | +Process attributes associated with "major" security modules should |
---|
| 33 | +be accessed and maintained using the special files in ``/proc/.../attr``. |
---|
| 34 | +A security module may maintain a module specific subdirectory there, |
---|
| 35 | +named after the module. ``/proc/.../attr/smack`` is provided by the Smack |
---|
| 36 | +security module and contains all its special files. The files directly |
---|
| 37 | +in ``/proc/.../attr`` remain as legacy interfaces for modules that provide |
---|
| 38 | +subdirectories. |
---|
| 39 | + |
---|
33 | 40 | .. toctree:: |
---|
34 | 41 | :maxdepth: 1 |
---|
35 | 42 | |
---|
.. | .. |
---|
39 | 46 | Smack |
---|
40 | 47 | tomoyo |
---|
41 | 48 | Yama |
---|
| 49 | + SafeSetID |
---|