UBUNTU: SAUCE: LSM stacking: add configs for LSM stacking

BugLink: http://bugs.launchpad.net/bugs/1763062
Add the config options for LSM stacking. Default to only apparmor
being in the stack. Users can experiment with stacking by specifying
the
     security=

kernel boot parameter.
  eg.
     security=apparmor,selinux

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 43e0e8a60e9db53bf0a512c8fd693aed216c47fb..008d87722b7d9c34a13ca8be91649e6412e488ab 100644 (file)
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -11532,6 +11532,7 @@ CONFIG_KEY_DH_OPERATIONS                        policy<{'amd64': 'y', 'arm64': '
 
 # Menu: Security options >> Enable different security models
 CONFIG_SECURITY                                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_STACKING                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SECURITY_NETWORK                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SECURITY_INFINIBAND                      policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SECURITY_NETWORK_XFRM                    policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
@@ -11540,9 +11541,13 @@ CONFIG_LSM_MMAP_MIN_ADDR                        policy<{'amd64': '0', 'arm64': '
 CONFIG_SECURITY_LOADPIN                         policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_SECURITY_YAMA                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 #
+CONFIG_SECURITY_DEFAULT_DISPLAY_APPARMOR        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_SECURITY_DEFAULT_DISPLAY_NAME            policy<{'amd64': '"apparmor"', 'arm64': '"apparmor"', 'armhf': '"apparmor"', 'i386': '"apparmor"', 'ppc64el': '"apparmor"', 's390x': '"apparmor"'}>
+
 CONFIG_SECURITY                                 mark<ENFORCED>
 CONFIG_LSM_MMAP_MIN_ADDR                        mark<ENFORCED> flag<REVIEW>
 CONFIG_SECURITY_YAMA                            mark<ENFORCED>
+CONFIG_SECURITY_DEFAULT_DISPLAY_NAME            mark<ENFORCED>
 
 # Menu: Security options >> Enable different security models >> AppArmor support
 CONFIG_SECURITY_APPARMOR                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index a0615d602c74fcd26773c87a2f70e4041d0b5fbf..88977ed7dd3c681f9987c730cc066a103e4a6201 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -2109,10 +2109,6 @@ CONFIG_DEFAULT_IO_DELAY_TYPE=1
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_SECURITY="apparmor"
 CONFIG_DEFAULT_SECURITY_APPARMOR=y
-# CONFIG_DEFAULT_SECURITY_DAC is not set
-# CONFIG_DEFAULT_SECURITY_SELINUX is not set
-# CONFIG_DEFAULT_SECURITY_SMACK is not set
-# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_DEFAULT_UIMAGE is not set
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
@@ -7812,9 +7808,13 @@ CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
 # CONFIG_SECURITY_APPARMOR_DEBUG is not set
 CONFIG_SECURITY_APPARMOR_HASH=y
 CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
+CONFIG_SECURITY_APPARMOR_STACKED=y
+CONFIG_SECURITY_DEFAULT_DISPLAY_APPARMOR=y
+CONFIG_SECURITY_DEFAULT_DISPLAY_NAME="apparmor"
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
 CONFIG_SECURITY_INFINIBAND=y
 # CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_LSM_DEBUG is not set
 CONFIG_SECURITY_NETWORK=y
 CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
@@ -7825,16 +7825,20 @@ CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
 CONFIG_SECURITY_SELINUX_DEVELOP=y
 # CONFIG_SECURITY_SELINUX_DISABLE is not set
+# CONFIG_SECURITY_SELINUX_STACKED is not set
 CONFIG_SECURITY_SMACK=y
 CONFIG_SECURITY_SMACK_APPEND_SIGNALS=y
 # CONFIG_SECURITY_SMACK_BRINGUP is not set
 CONFIG_SECURITY_SMACK_NETFILTER=y
+# CONFIG_SECURITY_SMACK_STACKED is not set
+CONFIG_SECURITY_STACKING=y
 CONFIG_SECURITY_TOMOYO=y
 CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER="/sbin/init"
 CONFIG_SECURITY_TOMOYO_MAX_ACCEPT_ENTRY=2048
 CONFIG_SECURITY_TOMOYO_MAX_AUDIT_LOG=1024
 # CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER is not set
 CONFIG_SECURITY_TOMOYO_POLICY_LOADER="/sbin/tomoyo-init"
+# CONFIG_SECURITY_TOMOYO_STACKED is not set
 # CONFIG_SECURITY_WRITABLE_HOOKS is not set
 CONFIG_SECURITY_YAMA=y
 CONFIG_SELECT_MEMORY_MODEL=y