The LSM usage document (Documentation/admin-guide/LSM/index.rst) has
not kept up with the LSM stacking infrastructure. It still describes
CONFIG_DEFAULT_SECURITY, which no longer exists, and its description
of the module ordering in /sys/kernel/security/lsm does not match
what the framework actually does.

Patch 1 updates the selection mechanism description to CONFIG_LSM and
the "lsm=" parameter, keeping "security=" documented as the deprecated
legacy option. This revisits an earlier attempt by Randy Dunlap [1]
that was rejected for treating the two parameters as equivalent; the
new text keeps them distinct.

Patch 2 fixes the ordering description: lockdown precedes capability
when CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is enabled, the integrity
modules are always placed at the end of the list, and the remaining
modules follow the order given by CONFIG_LSM or "lsm=".

[1] https://lore.kernel.org/r/20250114225156.10458-1-rdunlap@infradead.org

Lincoln Wallace (2):
  doc: LSM: describe CONFIG_LSM and lsm= as the selection mechanism
  doc: LSM: fix module ordering description for /sys/kernel/security/lsm

 Documentation/admin-guide/LSM/index.rst | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

-- 
2.53.0

On 7/13/2026 6:38 PM, Lincoln Wallace wrote:
> The LSM usage document (Documentation/admin-guide/LSM/index.rst) has
> not kept up with the LSM stacking infrastructure. It still describes
> CONFIG_DEFAULT_SECURITY, which no longer exists, and its description
> of the module ordering in /sys/kernel/security/lsm does not match
> what the framework actually does.

I've been stewing on this since it came up. We should probably
remove the somewhat complicated logic from the Kconfig files if
it's not adding value.

>
> Patch 1 updates the selection mechanism description to CONFIG_LSM and
> the "lsm=" parameter, keeping "security=" documented as the deprecated
> legacy option. This revisits an earlier attempt by Randy Dunlap [1]
> that was rejected for treating the two parameters as equivalent; the
> new text keeps them distinct.
>
> Patch 2 fixes the ordering description: lockdown precedes capability
> when CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is enabled, the integrity
> modules are always placed at the end of the list, and the remaining
> modules follow the order given by CONFIG_LSM or "lsm=".
>
> [1] https://lore.kernel.org/r/20250114225156.10458-1-rdunlap@infradead.org
>
> Lincoln Wallace (2):
>   doc: LSM: describe CONFIG_LSM and lsm= as the selection mechanism
>   doc: LSM: fix module ordering description for /sys/kernel/security/lsm
>
>  Documentation/admin-guide/LSM/index.rst | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)
>

On Thu, Jul 23, 2026 at 10:47:12AM -0700, Casey Schaufler wrote:
> I've been stewing on this since it came up. We should probably
> remove the somewhat complicated logic from the Kconfig files if
> it's not adding value.

That seems worth doing, but it looks like a separate change to me.
The document currently describes behaviour the code does not have,
and that's worth correcting either way. If the Kconfig is simplified
later, updating these paragraphs again should be a small part of that
series.

Happy to help with the Kconfig cleanup if that would be useful.

Do you see anything in the two patches that needs adjusting as they
stand?