[PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

KP Singh kpsingh at chromium.org
Mon Jul 6 18:59:13 UTC 2020

On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann <daniel at iogearbox.net> wrote:
> On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> > This option adds a kernel parameter 'bpf_lsm',
> > which allows the BPF LSM to be disabled at boot.
> > The purpose of this option is to allow a single kernel
> > image to be distributed with the BPF LSM built in,
> > but not necessarily enabled.
> >
> > Signed-off-by: Lorenzo Fontana <fontanalorenz at gmail.com>
> Well, this explains what the patch is doing but not *why* you need it exactly.
> Please explain your concrete use-case for this patch.

Also, this patch is not really needed as it can already be done with the current
kernel parameters.

LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.

- KP

> Thanks,
> Daniel

More information about the Linux-security-module-archive mailing list