Other LSM notes

A number of LSM-based modules exist now
NSA SELinux
Linux capabilities
OpenWall RLIMIT_NPROC
OpenWall SECURITY_LINK
Domain and Type Enforcement (DTE)

Modules can be stacked
But base module decides how to handle it

Some good documentation exists...
...as part of the LSM patch.