For some reason I didn't get 2/2 so I can't make an inline comment but
one thing I noticed while trying to build a smack kernel is that smack
has a kconfig dependancy on NETLABEL and SECURITY_NETWORK. This is
unfortunate because user X wanting to try out smack won't see it in the
config until he goes and enables those things (which he wouldn't know
about without reading the smack Kconfig). It would be nice if those were
selects instead.
-