1 files changed, 9 insertions, 36 deletions

diff --git a/security/Kconfig b/security/Kconfig
index e4fe2f3c2c65..1d6463fb1450 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -40,8 +40,7 @@ config SECURITYFS
         bool "Enable the securityfs filesystem"
         help
           This will build the securityfs filesystem.  It is currently used by
-          the TPM bios character driver and IMA, an integrity provider.  It is
-          not used by SELinux or SMACK.
+          various security modules (AppArmor, IMA, SafeSetID, TOMOYO, TPM).
 
           If you are unsure how to answer this question, answer N.
 
@@ -236,45 +235,19 @@ source "security/tomoyo/Kconfig"
 source "security/apparmor/Kconfig"
 source "security/loadpin/Kconfig"
 source "security/yama/Kconfig"
+source "security/safesetid/Kconfig"
 
 source "security/integrity/Kconfig"
 
-choice
-        prompt "Default security module"
-        default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
-        default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
-        default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
-        default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
-        default DEFAULT_SECURITY_DAC
-
+config LSM
+        string "Ordered list of enabled LSMs"
+        default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
         help
-          Select the security module that will be used by default if the
-          kernel parameter security= is not specified.
-
-        config DEFAULT_SECURITY_SELINUX
-                bool "SELinux" if SECURITY_SELINUX=y
-
-        config DEFAULT_SECURITY_SMACK
-                bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
-
-        config DEFAULT_SECURITY_TOMOYO
-                bool "TOMOYO" if SECURITY_TOMOYO=y
-
-        config DEFAULT_SECURITY_APPARMOR
-                bool "AppArmor" if SECURITY_APPARMOR=y
-
-        config DEFAULT_SECURITY_DAC
-                bool "Unix Discretionary Access Controls"
-
-endchoice
+          A comma-separated list of LSMs, in initialization order.
+          Any LSMs left off this list will be ignored. This can be
+          controlled at boot with the "lsm=" parameter.
 
-config DEFAULT_SECURITY
-        string
-        default "selinux" if DEFAULT_SECURITY_SELINUX
-        default "smack" if DEFAULT_SECURITY_SMACK
-        default "tomoyo" if DEFAULT_SECURITY_TOMOYO
-        default "apparmor" if DEFAULT_SECURITY_APPARMOR
-        default "" if DEFAULT_SECURITY_DAC
+          If unsure, leave this as the default.
 
 endmenu