| .. | .. |
|---|
| 17 | 17 | specific changes to system operation when these tweaks are not available |
|---|
| 18 | 18 | in the core functionality of Linux itself. |
|---|
| 19 | 19 | |
|---|
| 20 | | -Without a specific LSM built into the kernel, the default LSM will be the |
|---|
| 21 | | -Linux capabilities system. Most LSMs choose to extend the capabilities |
|---|
| 22 | | -system, building their checks on top of the defined capability hooks. |
|---|
| 20 | +The Linux capabilities modules will always be included. This may be |
|---|
| 21 | +followed by any number of "minor" modules and at most one "major" module. |
|---|
| 23 | 22 | For more details on capabilities, see ``capabilities(7)`` in the Linux |
|---|
| 24 | 23 | man-pages project. |
|---|
| 25 | 24 | |
|---|
| .. | .. |
|---|
| 30 | 29 | be first, followed by any "minor" modules (e.g. Yama) and then |
|---|
| 31 | 30 | the one "major" module (e.g. SELinux) if there is one configured. |
|---|
| 32 | 31 | |
|---|
| 32 | +Process attributes associated with "major" security modules should |
|---|
| 33 | +be accessed and maintained using the special files in ``/proc/.../attr``. |
|---|
| 34 | +A security module may maintain a module specific subdirectory there, |
|---|
| 35 | +named after the module. ``/proc/.../attr/smack`` is provided by the Smack |
|---|
| 36 | +security module and contains all its special files. The files directly |
|---|
| 37 | +in ``/proc/.../attr`` remain as legacy interfaces for modules that provide |
|---|
| 38 | +subdirectories. |
|---|
| 39 | + |
|---|
| 33 | 40 | .. toctree:: |
|---|
| 34 | 41 | :maxdepth: 1 |
|---|
| 35 | 42 | |
|---|
| .. | .. |
|---|
| 39 | 46 | Smack |
|---|
| 40 | 47 | tomoyo |
|---|
| 41 | 48 | Yama |
|---|
| 49 | + SafeSetID |
|---|