Linux Security Modules (LSM)
kernel-featureopen sourceA kernel framework of hook points at every security-relevant decision, where a pluggable module answers allow or deny.
documentedKernel docs: LSM ↗
is a framework inside the kernel: a set of hook points placed at every security-relevant decision, opening a file, executing a binary, connecting a socket, ptrace, mount. At each hook the kernel asks any registered module 'is this allowed?'. It exists so the kernel does not hardcode one security model. An runs after the standard DAC permission check and can only further restrict, it never grants extra access. SELinux, AppArmor, and Landlock are all .
Strengths
- Neutral, pluggable policy layer, the kernel exposes hooks, modules supply the model
- Can only tighten, never loosen, the standard permission check
- Fires deep in the kernel on resolved objects (inodes, sockets, tasks)
Limitations
- A framework, not a policy, you still choose and configure a concrete module
- Classic LSMs (SELinux/AppArmor) are privileged and system-wide; only Landlock is unprivileged
- Shared kernel, a kernel LPE is below it