• Tetsuo Handa's avatar
    TOMOYO: Make several options configurable. · 0e4ae0e0
    Tetsuo Handa authored
    To be able to start using enforcing mode from the early stage of boot sequence,
    this patch adds support for activating access control without calling external
    policy loader program. This will be useful for systems where operations which
    can lead to the hijacking of the boot sequence are needed before loading the
    policy. For example, you can activate immediately after loading the fixed part
    of policy which will allow only operations needed for mounting a partition
    which contains the variant part of policy and verifying (e.g. running GPG
    check) and loading the variant part of policy. Since you can start using
    enforcing mode from the beginning, you can reduce the possibility of hijacking
    the boot sequence.
    
    This patch makes several variables configurable on build time. This patch also
    adds TOMOYO_loader= and TOMOYO_trigger= kernel command line option to boot the
    same kernel in two different init systems (BSD-style init and systemd).
    Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    0e4ae0e0
common.c 63.3 KB