Re: [PATCH 0/2] doc: LSM: update usage document for current LSM stacking

[Casey Schaufler]

On 7/13/2026 6:38 PM, Lincoln Wallace wrote:
> The LSM usage document (Documentation/admin-guide/LSM/index.rst) has
> not kept up with the LSM stacking infrastructure. It still describes
> CONFIG_DEFAULT_SECURITY, which no longer exists, and its description
> of the module ordering in /sys/kernel/security/lsm does not match
> what the framework actually does.

I've been stewing on this since it came up. We should probably
remove the somewhat complicated logic from the Kconfig files if
it's not adding value.

>
> Patch 1 updates the selection mechanism description to CONFIG_LSM and
> the "lsm=" parameter, keeping "security=" documented as the deprecated
> legacy option. This revisits an earlier attempt by Randy Dunlap [1]
> that was rejected for treating the two parameters as equivalent; the
> new text keeps them distinct.
>
> Patch 2 fixes the ordering description: lockdown precedes capability
> when CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is enabled, the integrity
> modules are always placed at the end of the list, and the remaining
> modules follow the order given by CONFIG_LSM or "lsm=".
>
> [1] https://lore.kernel.org/r/20250114225156.10458-1-rdunlap@xxxxxxxxxxxxx
>
> Lincoln Wallace (2):
>   doc: LSM: describe CONFIG_LSM and lsm= as the selection mechanism
>   doc: LSM: fix module ordering description for /sys/kernel/security/lsm
>
>  Documentation/admin-guide/LSM/index.rst | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)
>