Searched refs:LSM (Results 1 – 25 of 44) sorted by relevance
12
| /Linux-v5.10/Documentation/netlabel/ |
| D | lsm_interface.rst | 13 network packets. It is intended to be used by LSM developers who want to make
27 configuration. It is up to the LSM developer to translate the NetLabel
29 particular LSM.
31 NetLabel LSM Protocol Operations
34 These are the functions which allow the LSM developer to manipulate the labels
44 label and the internal LSM security identifier can be time consuming. The
47 LSM has received a packet, used NetLabel to decode its security attributes,
48 and translated the security attributes into a LSM internal identifier the LSM
49 can use the NetLabel caching functions to associate the LSM internal
52 NetLabel translation mechanisms bypassed but the LSM translation mechanisms are
|
| D | cipso_ipv4.rst | 26 that it is set upon the socket's creation. The LSM can set the socket's CIPSO
35 IP layer without any special handling required by the LSM. However, in order
36 to decode and translate the CIPSO label on the packet the LSM must use the
39 LSM hook.
55 mappings from the network labels to the corresponding LSM identifiers. The
|
| D | introduction.rst | 47 LSM independent which should allow multiple LSMs to leverage the same code
|
| /Linux-v5.10/Documentation/admin-guide/LSM/ |
| D | tomoyo.rst | 8 TOMOYO is a name-based MAC extension (LSM module) for the Linux kernel.
15 Though these tutorials use non-LSM version of TOMOYO, they are useful for you
59 multiple LSM modules at the same time. We feel sorry that you have to give up
62 We hope that LSM becomes stackable in future. Meanwhile, you can use non-LSM
64 LSM version of TOMOYO is a subset of non-LSM version of TOMOYO. We are planning
65 to port non-LSM version's functionalities to LSM versions.
|
| D | index.rst | 5 The Linux Security Module (LSM) framework provides a mechanism for
13 The primary users of the LSM interface are Mandatory Access Control
16 MAC extensions, other extensions can be built using the LSM to provide
|
| D | SafeSetID.rst | 4 SafeSetID is an LSM module that gates the setid family of syscalls to restrict
31 This SafeSetID LSM seeks to provide a solution for restricting setid
34 The main use case for this LSM is to allow a non-root program to transition to
37 additional restrictions imposed by this LSM would mean it is a "safer" version
54 as implemented in this LSM, an alternative option would be to simply take away
88 Use an existing LSM
99 This LSM hooks the setid syscalls to make sure transitions are allowed if an
|
| D | LoadPin.rst | 12 The LSM is selectable at build-time with ``CONFIG_SECURITY_LOADPIN``, and
|
| /Linux-v5.10/Documentation/security/ |
| D | lsm-development.rst | 6 a new LSM is accepted into the kernel when its intent (a description of
8 use it) has been appropriately documented in ``Documentation/admin-guide/LSM/``.
9 This allows an LSM's code to be easily compared to its goals, and so
13 For extensive documentation on the available LSM hook interfaces, please
|
| D | lsm.rst | 37 The Linux Security Modules (LSM) project was started by WireX to develop
38 such a framework. LSM was a joint development effort by several security
46 LSM Framework
49 The LSM framework provides a general kernel framework to support
50 security modules. In particular, the LSM framework is primarily focused
54 the infrastructure to support security modules. The LSM framework is
58 `LSM Capabilities Module`_.
60 The LSM framework includes security fields in kernel data structures and
67 The LSM security fields are simply ``void*`` pointers.
98 LSM hooks are maintained in lists. A list is maintained for each
[all …]
|
| D | SCTP.rst | 7 SCTP LSM Support
192 The `SCTP LSM Support`_ chapter above describes the following SCTP security
252 `SCTP LSM Support`_ gives a summary of the ``@optname``
|
| /Linux-v5.10/Documentation/bpf/ |
| D | bpf_lsm.rst | 5 LSM BPF Programs
8 These BPF programs allow runtime instrumentation of the LSM hooks by privileged
16 LSM hook:
20 Other LSM hooks which can be instrumented can be found in
61 * ``"lsm/file_mprotect"`` indicates the LSM hook that the program must
116 Attachment to LSM Hooks
119 The LSM allows attachment of eBPF programs as LSM hooks using :manpage:`bpf(2)`
123 The program can be detached from the LSM hook by *destroying* the ``link``
|
| /Linux-v5.10/Documentation/translations/zh_CN/process/ |
| D | 3.Early-stage.rst | 24 接到Linux安全模块（LSM）框架中；这个模块可以配置为允许特定的应用程序访问
28 内核社区来说，这被视为对LSM框架的滥用（LSM框架并不打算授予他们原本不具备的
|
| /Linux-v5.10/security/lockdown/ |
| D | Kconfig | 6 Build support for an LSM that enforces a coarse kernel lockdown
10 bool "Enable lockdown LSM early in init"
13 Enable the lockdown LSM early in boot. This is necessary in order
|
| /Linux-v5.10/Documentation/ABI/testing/ |
| D | ima_policy | 9 the policy can be constrained based on LSM specific data.
43 lsm: are LSM specific
102 Examples of LSM specific definitions:
|
| /Linux-v5.10/scripts/selinux/ |
| D | README | 1 Please see Documentation/admin-guide/LSM/SELinux.rst for information on
|
| /Linux-v5.10/security/yama/ |
| D | Kconfig | 12 Documentation/admin-guide/LSM/Yama.rst.
|
| /Linux-v5.10/security/safesetid/ |
| D | Kconfig | 8 SafeSetID is an LSM module that gates the setid family of syscalls to
|
| /Linux-v5.10/Documentation/networking/ |
| D | secid.rst | 4 LSM/SeLinux secid
|
| /Linux-v5.10/Documentation/translations/zh_CN/admin-guide/ |
| D | index.rst | 94 LSM/index
|
| /Linux-v5.10/Documentation/ABI/obsolete/ |
| D | sysfs-selinux-disable | 16 kernel's LSM hooks using the "__ro_after_init" feature.
|
| /Linux-v5.10/security/ |
| D | Kconfig | 130 int "Low address space for LSM to protect from user allocation"
144 systems running LSM.
245 prompt "First legacy 'major LSM' to be initialized"
278 config LSM config
|
| /Linux-v5.10/fs/proc/ |
| D | base.c | 148 #define ATTR(LSM, NAME, MODE) \ argument
151 { .lsm = LSM })
2759 #define LSM_DIR_OPS(LSM) \ argument
2760 static int proc_##LSM##_attr_dir_iterate(struct file *filp, \
2764 LSM##_attr_dir_stuff, \
2765 ARRAY_SIZE(LSM##_attr_dir_stuff)); \
2768 static const struct file_operations proc_##LSM##_attr_dir_ops = { \
2770 .iterate = proc_##LSM##_attr_dir_iterate, \
2774 static struct dentry *proc_##LSM##_attr_dir_lookup(struct inode *dir, \
2778 LSM##_attr_dir_stuff, \
[all …]
|
| /Linux-v5.10/Documentation/admin-guide/ |
| D | index.rst | 97 LSM/index
|
| /Linux-v5.10/Documentation/userspace-api/ |
| D | no_new_privs.rst | 39 interfere with LSM-based sandboxing.)
|
| /Linux-v5.10/tools/perf/Documentation/ |
| D | security.txt | 8 Enabling LSM based mandatory access control (MAC) to perf_event_open() syscall
11 LSM hooks for mandatory access control for perf_event_open() syscall can be
|
12
