Re: [PATCH security-next v3 18/29] LSM: Introduce lsm.enable= and lsm.disable=

[Kees Cook]

On Mon, Oct 1, 2018 at 4:44 PM, John Johansen
<john.johansen@xxxxxxxxxxxxx> wrote:
> On 10/01/2018 04:30 PM, Kees Cook wrote:
>> If we keep it, "apparmor=0 lsm_enable=apparmor" would mean it's
>> enabled. Is that okay?
>>
> ugh I would rather get rid of apparmor=0 or to emit a warning with apparmor
> disabled, but if we have to live with it then yes I can live with last
> option wins

Removing it would be much preferred! :)

Assuming Paul is okay with the same results in SELinux, I'll prepare patches...

-Kees

-- 
Kees Cook
Pixel Security