Re: Post-halloween doc updates.

[Chris Wright <chrisw@osdl.org>]

* Randy.Dunlap (rddunlap@osdl.org) wrote:
> | SELinux.
> | ~~~~~~~~
> | NSA Security-Enhanced Linux (SELinux) got merged in 2.6.
> | It is disabled by default and can be enabled with a boot time parameter
> | selinux=1.
> | You can obtain SELinux tools and an example policy configuration from
> | http://www.nsa.gov/selinux
> 
> Somebody correct me here if needed...
> selinux can't just be enabled by using 'selinux=1', if the config
> options are set for checking that.
> The way that I read security/selinux/Kconfig and hooks.c,
> if SECURITY_SELINUX_BOOTPARAM is enabled, then the 'selinux'
> boot option is also enabled.  However, it can be disabled by using
> 'selinux=0' as a kernel boot option.

This is correct.  SELinux defaults to not being config'd in.  If you
config it in it defaults to enabled.  If you also config the bootparam
you can use that param to disable it, otherwise selinux=1 is redundant
as that's the default.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net