€•Ï^Œsphinx.addnodes”Œdocument”“”)”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)”}”(hhh]”(hŒ pending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ /translations/zh_CN/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/zh_TW/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/it_IT/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/ja_JP/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/ko_KR/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒPortuguese (Brazilian)”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/pt_BR/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒSpanish”…””}”hh–sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ /translations/sp_SP/security/lsm”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ8Linux Security Modules: General Security Hooks for Linux”h]”hŒ8Linux Security Modules: General Security Hooks for Linux”…””}”(hh¼h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhh·h²hh³Œ:/var/lib/git/docbuild/linux/Documentation/security/lsm.rst”h´KubhŒ field_list”“”)”}”(hhh]”(hŒfield”“”)”}”(hhh]”(hŒ field_name”“”)”}”(hŒAuthor”h]”hŒAuthor”…””}”(hh×h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÕhhÒh³hÊh´KubhŒ field_body”“”)”}”(hŒStephen Smalley”h]”hŒ paragraph”“”)”}”(hhéh]”hŒStephen Smalley”…””}”(hhíh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´Khhçubah}”(h]”h ]”h"]”h$]”h&]”uh1håhhÒubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÐh³hÊh´KhhÍh²hubhÑ)”}”(hhh]”(hÖ)”}”(hŒAuthor”h]”hŒAuthor”…””}”(hj h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÕhjh³hÊh´Kubhæ)”}”(hŒTimothy Fraser”h]”hì)”}”(hjh]”hŒTimothy Fraser”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´Khjubah}”(h]”h ]”h"]”h$]”h&]”uh1håhjubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÐh³hÊh´KhhÍh²hubhÑ)”}”(hhh]”(hÖ)”}”(hŒAuthor”h]”hŒAuthor”…””}”(hj7h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÕhj4h³hÊh´Kubhæ)”}”(hŒ Chris Vance ”h]”hì)”}”(hŒ Chris Vance”h]”hŒ Chris Vance”…””}”(hjIh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KhjEubah}”(h]”h ]”h"]”h$]”h&]”uh1håhj4ubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÐh³hÊh´KhhÍh²hubeh}”(h]”h ]”h"]”h$]”h&]”uh1hËhh·h²hh³hÊh´KubhŒnote”“”)”}”(hŒ-The APIs described in this book are outdated.”h]”hì)”}”(hjmh]”hŒ-The APIs described in this book are outdated.”…””}”(hjoh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´K hjkubah}”(h]”h ]”h"]”h$]”h&]”uh1jihh·h²hh³hÊh´Nubh¶)”}”(hhh]”(h»)”}”(hŒ Introduction”h]”hŒ Introduction”…””}”(hj…h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhj‚h²hh³hÊh´Kubhì)”}”(hX‡In March 2001, the National Security Agency (NSA) gave a presentation about Security-Enhanced Linux (SELinux) at the 2.5 Linux Kernel Summit. SELinux is an implementation of flexible and fine-grained nondiscretionary access controls in the Linux kernel, originally implemented as its own particular kernel patch. Several other security projects (e.g. RSBAC, Medusa) have also developed flexible access control architectures for the Linux kernel, and various projects have developed particular access control models for Linux (e.g. LIDS, DTE, SubDomain). Each project has developed and maintained its own kernel patch to support its security needs.”h]”hX‡In March 2001, the National Security Agency (NSA) gave a presentation about Security-Enhanced Linux (SELinux) at the 2.5 Linux Kernel Summit. SELinux is an implementation of flexible and fine-grained nondiscretionary access controls in the Linux kernel, originally implemented as its own particular kernel patch. Several other security projects (e.g. RSBAC, Medusa) have also developed flexible access control architectures for the Linux kernel, and various projects have developed particular access control models for Linux (e.g. LIDS, DTE, SubDomain). Each project has developed and maintained its own kernel patch to support its security needs.”…””}”(hj“h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´Khj‚h²hubhì)”}”(hX]In response to the NSA presentation, Linus Torvalds made a set of remarks that described a security framework he would be willing to consider for inclusion in the mainstream Linux kernel. He described a general framework that would provide a set of security hooks to control operations on kernel objects and a set of opaque security fields in kernel data structures for maintaining security attributes. This framework could then be used by loadable kernel modules to implement any desired model of security. Linus also suggested the possibility of migrating the Linux capabilities code into such a module.”h]”hX]In response to the NSA presentation, Linus Torvalds made a set of remarks that described a security framework he would be willing to consider for inclusion in the mainstream Linux kernel. He described a general framework that would provide a set of security hooks to control operations on kernel objects and a set of opaque security fields in kernel data structures for maintaining security attributes. This framework could then be used by loadable kernel modules to implement any desired model of security. Linus also suggested the possibility of migrating the Linux capabilities code into such a module.”…””}”(hj¡h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´Khj‚h²hubhì)”}”(hXñThe Linux Security Modules (LSM) project was started by WireX to develop such a framework. LSM was a joint development effort by several security projects, including Immunix, SELinux, SGI and Janus, and several individuals, including Greg Kroah-Hartman and James Morris, to develop a Linux kernel patch that implements this framework. The work was incorporated in the mainstream in December of 2003. This technical report provides an overview of the framework and the capabilities security module.”h]”hXñThe Linux Security Modules (LSM) project was started by WireX to develop such a framework. LSM was a joint development effort by several security projects, including Immunix, SELinux, SGI and Janus, and several individuals, including Greg Kroah-Hartman and James Morris, to develop a Linux kernel patch that implements this framework. The work was incorporated in the mainstream in December of 2003. This technical report provides an overview of the framework and the capabilities security module.”…””}”(hj¯h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´K%hj‚h²hubeh}”(h]”Œ introduction”ah ]”h"]”Œ introduction”ah$]”h&]”uh1hµhh·h²hh³hÊh´Kubh¶)”}”(hhh]”(h»)”}”(hŒ LSM Framework”h]”hŒ LSM Framework”…””}”(hjÈh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhjÅh²hh³hÊh´K/ubhì)”}”(hXaThe LSM framework provides a general kernel framework to support security modules. In particular, the LSM framework is primarily focused on supporting access control modules, although future development is likely to address other security needs such as sandboxing. By itself, the framework does not provide any additional security; it merely provides the infrastructure to support security modules. The LSM framework is optional, requiring `CONFIG_SECURITY` to be enabled. The capabilities logic is implemented as a security module. This capabilities module is discussed further in `LSM Capabilities Module`_.”h]”(hX¸The LSM framework provides a general kernel framework to support security modules. In particular, the LSM framework is primarily focused on supporting access control modules, although future development is likely to address other security needs such as sandboxing. By itself, the framework does not provide any additional security; it merely provides the infrastructure to support security modules. The LSM framework is optional, requiring ”…””}”(hjÖh²hh³Nh´NubhŒtitle_reference”“”)”}”(hŒ`CONFIG_SECURITY`”h]”hŒCONFIG_SECURITY”…””}”(hjàh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÞhjÖubhŒ} to be enabled. The capabilities logic is implemented as a security module. This capabilities module is discussed further in ”…””}”(hjÖh²hh³Nh´NubhŒ reference”“”)”}”(hŒ`LSM Capabilities Module`_”h]”hŒLSM Capabilities Module”…””}”(hjôh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”ŒLSM Capabilities Module”Œrefid”Œlsm-capabilities-module”uh1jòhjÖŒresolved”KubhŒ.”…””}”(hjÖh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´K1hjÅh²hubhì)”}”(hXvThe LSM framework includes security fields in kernel data structures and calls to hook functions at critical points in the kernel code to manage the security fields and to perform access control. It also adds functions for registering security modules. An interface `/sys/kernel/security/lsm` reports a comma separated list of security modules that are active on the system.”h]”(hX The LSM framework includes security fields in kernel data structures and calls to hook functions at critical points in the kernel code to manage the security fields and to perform access control. It also adds functions for registering security modules. An interface ”…””}”(hjh²hh³Nh´Nubjß)”}”(hŒ`/sys/kernel/security/lsm`”h]”hŒ/sys/kernel/security/lsm”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÞhjubhŒR reports a comma separated list of security modules that are active on the system.”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´K` and :c:type:`struct cred `. For filesystem security information, a security field is included in :c:type:`struct super_block `. For pipe, file, and socket security information, security fields are included in :c:type:`struct inode ` and :c:type:`struct file `. For System V IPC security information, security fields were added to :c:type:`struct kern_ipc_perm ` and :c:type:`struct msg_msg `; additionally, the definitions for :c:type:`struct msg_msg `, struct msg_queue, and struct shmid_kernel were moved to header files (``include/linux/msg.h`` and ``include/linux/shm.h`` as appropriate) to allow the security modules to use these definitions.”h]”(hŒ#The LSM security fields are simply ”…””}”(hj1h²hh³Nh´NubhŒliteral”“”)”}”(hŒ ``void*``”h]”hŒvoid*”…””}”(hj;h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj1ubhXE pointers. The data is referred to as a blob, which may be managed by the framework or by the individual security modules that use it. Security blobs that are used by more than one security module are typically managed by the framework. For process and program execution security information, security fields are included in ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ*:c:type:`struct task_struct `”h]”j:)”}”(hjOh]”hŒstruct task_struct”…””}”(hjQh²hh³Nh´Nubah}”(h]”h ]”(Œxref”Œc”Œc-type”eh"]”h$]”h&]”uh1j9hjMubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”Œ security/lsm”Œ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰Œ reftarget”Œ task_struct”uh1hh³hÊh´KChj1ubhŒ and ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ:c:type:`struct cred `”h]”j:)”}”(hjvh]”hŒ struct cred”…””}”(hjxh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjtubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒcred”uh1hh³hÊh´KChj1ubhŒG. For filesystem security information, a security field is included in ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ*:c:type:`struct super_block `”h]”j:)”}”(hj™h]”hŒstruct super_block”…””}”(hj›h²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hj—ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒ super_block”uh1hh³hÊh´KChj1ubhŒS. For pipe, file, and socket security information, security fields are included in ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ:c:type:`struct inode `”h]”j:)”}”(hj¼h]”hŒ struct inode”…””}”(hj¾h²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjºubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒinode”uh1hh³hÊh´KChj1ubhŒ and ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ:c:type:`struct file `”h]”j:)”}”(hjßh]”hŒ struct file”…””}”(hjáh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjÝubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒfile”uh1hh³hÊh´KChj1ubhŒG. For System V IPC security information, security fields were added to ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ.:c:type:`struct kern_ipc_perm `”h]”j:)”}”(hjh]”hŒstruct kern_ipc_perm”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒ kern_ipc_perm”uh1hh³hÊh´KChj1ubhŒ and ”…””}”hj1sbh)”}”(hŒ":c:type:`struct msg_msg `”h]”j:)”}”(hj%h]”hŒstruct msg_msg”…””}”(hj'h²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hj#ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒmsg_msg”uh1hh³hÊh´KChj1ubhŒ$; additionally, the definitions for ”…””}”(hj1h²hh³Nh´Nubh)”}”(hŒ":c:type:`struct msg_msg `”h]”j:)”}”(hjHh]”hŒstruct msg_msg”…””}”(hjJh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjFubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒmsg_msg”uh1hh³hÊh´KChj1ubhŒH, struct msg_queue, and struct shmid_kernel were moved to header files (”…””}”(hj1h²hh³Nh´Nubj:)”}”(hŒ``include/linux/msg.h``”h]”hŒinclude/linux/msg.h”…””}”(hjih²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj1ubhŒ and ”…””}”hj1sbj:)”}”(hŒ``include/linux/shm.h``”h]”hŒinclude/linux/shm.h”…””}”(hj{h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj1ubhŒH as appropriate) to allow the security modules to use these definitions.”…””}”(hj1h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KChjÅh²hubhì)”}”(hX]For packet and network device security information, security fields were added to :c:type:`struct sk_buff ` and :c:type:`struct scm_cookie `. Unlike the other security module data, the data used here is a 32-bit integer. The security modules are required to map or otherwise associate these values with real security attributes.”h]”(hŒRFor packet and network device security information, security fields were added to ”…””}”(hj“h²hh³Nh´Nubh)”}”(hŒ":c:type:`struct sk_buff `”h]”j:)”}”(hjh]”hŒstruct sk_buff”…””}”(hjŸh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hj›ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒsk_buff”uh1hh³hÊh´KZhj“ubhŒ and ”…””}”(hj“h²hh³Nh´Nubh)”}”(hŒ(:c:type:`struct scm_cookie `”h]”j:)”}”(hjÀh]”hŒstruct scm_cookie”…””}”(hjÂh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hj¾ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒ scm_cookie”uh1hh³hÊh´KZhj“ubhŒ¼. Unlike the other security module data, the data used here is a 32-bit integer. The security modules are required to map or otherwise associate these values with real security attributes.”…””}”(hj“h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KZhjÅh²hubhì)”}”(hŒàLSM hooks are maintained in lists. A list is maintained for each hook, and the hooks are called in the order specified by CONFIG_LSM. Detailed documentation for each hook is included in the `security/security.c` source file.”h]”(hŒ¾LSM hooks are maintained in lists. A list is maintained for each hook, and the hooks are called in the order specified by CONFIG_LSM. Detailed documentation for each hook is included in the ”…””}”(hjçh²hh³Nh´Nubjß)”}”(hŒ`security/security.c`”h]”hŒsecurity/security.c”…””}”(hjïh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÞhjçubhŒ source file.”…””}”(hjçh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KbhjÅh²hubhì)”}”(hXÄThe LSM framework provides for a close approximation of general security module stacking. It defines security_add_hooks() to which each security module passes a :c:type:`struct security_hooks_list `, which are added to the lists. The LSM framework does not provide a mechanism for removing hooks that have been registered. The SELinux security module has implemented a way to remove itself, however the feature has been deprecated.”h]”(hŒ¡The LSM framework provides for a close approximation of general security module stacking. It defines security_add_hooks() to which each security module passes a ”…””}”(hjh²hh³Nh´Nubh)”}”(hŒ::c:type:`struct security_hooks_list `”h]”j:)”}”(hjh]”hŒstruct security_hooks_list”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”ˆŒrefwarn”‰jnŒsecurity_hooks_list”uh1hh³hÊh´KghjubhŒé, which are added to the lists. The LSM framework does not provide a mechanism for removing hooks that have been registered. The SELinux security module has implemented a way to remove itself, however the feature has been deprecated.”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KghjÅh²hubhì)”}”(hXáThe hooks can be viewed as falling into two major categories: hooks that are used to manage the security fields and hooks that are used to perform access control. Examples of the first category of hooks include the security_inode_alloc() and security_inode_free() These hooks are used to allocate and free security structures for inode objects. An example of the second category of hooks is the security_inode_permission() hook. This hook checks permission when accessing an inode.”h]”hXáThe hooks can be viewed as falling into two major categories: hooks that are used to manage the security fields and hooks that are used to perform access control. Examples of the first category of hooks include the security_inode_alloc() and security_inode_free() These hooks are used to allocate and free security structures for inode objects. An example of the second category of hooks is the security_inode_permission() hook. This hook checks permission when accessing an inode.”…””}”(hj8h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´KphjÅh²hubeh}”(h]”Œ lsm-framework”ah ]”h"]”Œ lsm framework”ah$]”h&]”uh1hµhh·h²hh³hÊh´K/ubh¶)”}”(hhh]”(h»)”}”(hŒLSM Capabilities Module”h]”hŒLSM Capabilities Module”…””}”(hjQh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hºhjNh²hh³hÊh´K{ubhì)”}”(hX»The POSIX.1e capabilities logic is maintained as a security module stored in the file ``security/commoncap.c``. The capabilities module uses the order field of the :c:type:`lsm_info` description to identify it as the first security module to be registered. The capabilities security module does not use the general security blobs, unlike other modules. The reasons are historical and are based on overhead, complexity and performance concerns.”h]”(hŒVThe POSIX.1e capabilities logic is maintained as a security module stored in the file ”…””}”(hj_h²hh³Nh´Nubj:)”}”(hŒ``security/commoncap.c``”h]”hŒsecurity/commoncap.c”…””}”(hjgh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj_ubhŒ6. The capabilities module uses the order field of the ”…””}”(hj_h²hh³Nh´Nubh)”}”(hŒ:c:type:`lsm_info`”h]”j:)”}”(hj{h]”hŒlsm_info”…””}”(hj}h²hh³Nh´Nubah}”(h]”h ]”(j[j\Œc-type”eh"]”h$]”h&]”uh1j9hjyubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jhŒ refdomain”j\Œreftype”Œtype”Œ refexplicit”‰Œrefwarn”‰jnŒlsm_info”uh1hh³hÊh´K}hj_ubhX description to identify it as the first security module to be registered. The capabilities security module does not use the general security blobs, unlike other modules. The reasons are historical and are based on overhead, complexity and performance concerns.”…””}”(hj_h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÊh´K}hjNh²hubeh}”(h]”jah ]”h"]”Œlsm capabilities module”ah$]”h&]”uh1hµhh·h²hh³hÊh´K{Œ referenced”Kubeh}”(h]”Œ7linux-security-modules-general-security-hooks-for-linux”ah ]”h"]”Œ8linux security modules: general security hooks for linux”ah$]”h&]”uh1hµhhh²hh³hÊh´Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”hÊuh1hŒcurrent_source”NŒ current_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hºNŒ generator”NŒ datestamp”NŒ source_link”NŒ source_url”NŒ toc_backlinks”Œentry”Œfootnote_backlinks”KŒ sectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒ strip_classes”NŒ report_level”KŒ halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ traceback”ˆŒinput_encoding”Œ utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jÕŒerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œ language_code”Œen”Œrecord_dependencies”NŒconfig”NŒ id_prefix”hŒauto_id_prefix”Œid”Œ dump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”hÊŒ _destination”NŒ _config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒ raw_enabled”KŒline_length_limit”M'Œpep_references”NŒ pep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒ rfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œ smart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œ docinfo_xform”KŒsectsubtitle_xform”‰Œ image_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œlsm capabilities module”]”jôasŒrefids”}”Œnameids”}”(j¯j¬jÂj¿jKjHj¦juŒ nametypes”}”(j¯‰j‰jK‰j¦‰uh}”(j¬h·j¿j‚jHjÅjjNuŒ footnote_refs”}”Œ citation_refs”}”Œ autofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ footnotes”]”Œ citations”]”Œautofootnote_start”KŒsymbol_footnote_start”KŒ id_counter”Œ collections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œ transformer”NŒ include_log”]”Œ decoration”Nh²hub.