From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10D2036BCD7 for ; Tue, 14 Jul 2026 01:43:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783993428; cv=none; b=adkQR8fQy4nIvDUfeBrMFGc35P6ZRjhIkFfxt8Wd+L+8PHv4kpZSCL3CGSngplV2e9yR+1SyGqfvrvwCWp7iXfmNyaezBd7w2HxClmfJMB4r90RVn49ZES+NQ8wrtvmmRNHLgb2LMujn+qvidoi4UeUQ14JdvQ2Y8khOXMy4GYY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783993428; c=relaxed/simple; bh=dKZHmZi+xVQS5CbSi+LMf6D5ukNa65oK0aZqGSLgxrM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hTia/BAZKLH2p4GKGlSgOrKZeESwPRvShkXctCbl/wCPAeaXlKGnwAS4T9j0FRx+fndAAg3maqgNNDEzfYe2KORadAfJK3YMCizzhirMtcu5kvMR12okZTjp9bTqif/S96+AmJIFI/lnnxAvupQyVtB9oBKPfIMgC7UDtUr+QJ0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=luRz8Es4; arc=none smtp.client-ip=209.85.215.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="luRz8Es4" Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-c9e30214d8fso2627985a12.3 for ; Mon, 13 Jul 2026 18:43:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783993424; x=1784598224; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=gCQhDpUBQaP5eNAOavkcbS3PiRS94B5qHHxRvZHqb+U=; b=luRz8Es4fOKbrp/4HFzYfKSnxm53ZrBxqtDxxKYmYtXXRQywvuJbL9cXxvcQKgrTFH KtX/NF8TY8cQjqfs//DzIfNU4XDfHIm4XGxd6PfDLfOkGJbsw2CFfbypHwkC6gmS3Xv6 D64JsDeP9EtFZD9/ev87S1a7oCFyPOX/f4X8CHe9Usfo2MGNxoInQTXvpHlB1ZUsvOwS rcVmGXlwl2+iDuKEzYa9MJlg5xqWQErU3aKfg+62YBsqMw8Va19hdKRwA9+9n3y3RfTg 0OWer+IiKB8n7b8PH9JVRBX6ee9XpvU5HpXV9VBhsW8B0aA+nGbeH/Q7ij4YMeV+JuXX 5G8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783993424; x=1784598224; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gCQhDpUBQaP5eNAOavkcbS3PiRS94B5qHHxRvZHqb+U=; b=ci+fCI5eBacL0DT3N+eKsTbQXNtnm/lVX9oNrBVmP47u/9jgvJW1jJhzB6xTD1di4r 0SmEC6xnhyFPGdK3xVxR+lSurTrZt1sAftCneZ4I9PuHH228ETSsUi1A1YLi34JOcdtF HFSAHmeTCb2bhI6JwSA67Cvyuiorknsn7oi8eylpf8vvfrPYIF7JFDp0WBlFcWoiutk5 F9ig1mH8pNzaI3oiMjYWotDydHJ2dTgAjF92pJYIvRiGEPXxXbVTBOXw5bJdOfK2IYHH /C6Ydqlz8Z76BdmG8+NVGg6r0ZFYnilpkzs9BvOYVn4x31tl1HfPuTX8jYdh2sKPA67a wgUw== X-Forwarded-Encrypted: i=1; AHgh+Rrffgtr+gY3k8C6KKHmVBa1xYKQ9Q3YR919J5aMjuIL+swqKIO5/0b5y6zxmdUlZYKzblYwkZah9Mmkgow=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+l450VZwrgfLp0mbbRgrKX44PEJ8yduuhZzyKh9PKupcDZYkH 7KlQGqI8WPGmWTzirA+MdbfuLcmuWb6JctlN0o1Z+D+e3CPN5pJRbiD1 X-Gm-Gg: AfdE7clTGMBvnsMoq5Wgz8JBvq/MFfJkqCGCCeCQAc3Mbqv0Mlbvyye6iEkJFOfPytB hCw7PLTZ9ieW4GlevDhQbC0lHujyzCpHTAIhngzf76UnXWCUuKNCYnEOVGeNA1EOj/LyFJM5IbF eyQawnIMpc4Sj/9EVAaDU4GCp8Up6ytxftnL/7VFaT83883PWyVef0nzUAp6osISobDmXzV86Lo 0xm3lSiouUpYVZG/mF+9yE6VLiPT1c7/IIA6Av+M8f7XmbUzfXYz0VauClayfWOqU7AE9rjccud MIVdbMT1vDKI4MHO9TjWMwh73SAGO+4CjaqgZ+yY2Jb52/NQeD9TkC5qSe7wZtUHm0rLiTop4Tv fHPLM8CrnpUFmxzuEISnFO5ZK+juME9tYU+a2bY8CO0EV7IvC96T0JdQQCvOf2rJIQEtlQI68gg ZU4PhCv0jPPw== X-Received: by 2002:a05:6a21:730c:b0:3c0:9c19:65b7 with SMTP id adf61e73a8af0-3c110a207ebmr13095048637.63.1783993424197; Mon, 13 Jul 2026 18:43:44 -0700 (PDT) Received: from sleipnir ([2804:d45:3612:3b00:32a3:79f0:cdff:a04a]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b924258a2sm59675775c88.1.2026.07.13.18.43.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 18:43:43 -0700 (PDT) From: Lincoln Wallace To: paul@paul-moore.com, corbet@lwn.net Cc: skhan@linuxfoundation.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, penguin-kernel@I-love.SAKURA.ne.jp, rdunlap@infradead.org, Lincoln Wallace Subject: [PATCH 0/2] doc: LSM: update usage document for current LSM stacking Date: Mon, 13 Jul 2026 22:38:30 -0300 Message-ID: <20260714013832.977443-1-locnnil0@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The LSM usage document (Documentation/admin-guide/LSM/index.rst) has not kept up with the LSM stacking infrastructure. It still describes CONFIG_DEFAULT_SECURITY, which no longer exists, and its description of the module ordering in /sys/kernel/security/lsm does not match what the framework actually does. Patch 1 updates the selection mechanism description to CONFIG_LSM and the "lsm=" parameter, keeping "security=" documented as the deprecated legacy option. This revisits an earlier attempt by Randy Dunlap [1] that was rejected for treating the two parameters as equivalent; the new text keeps them distinct. Patch 2 fixes the ordering description: lockdown precedes capability when CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is enabled, the integrity modules are always placed at the end of the list, and the remaining modules follow the order given by CONFIG_LSM or "lsm=". [1] https://lore.kernel.org/r/20250114225156.10458-1-rdunlap@infradead.org Lincoln Wallace (2): doc: LSM: describe CONFIG_LSM and lsm= as the selection mechanism doc: LSM: fix module ordering description for /sys/kernel/security/lsm Documentation/admin-guide/LSM/index.rst | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) -- 2.53.0