1# 2# Security configuration 3# 4 5menu "Security options" 6 7source security/keys/Kconfig 8 9config SECURITY_DMESG_RESTRICT 10 bool "Restrict unprivileged access to the kernel syslog" 11 default n 12 help 13 This enforces restrictions on unprivileged users reading the kernel 14 syslog via dmesg(8). 15 16 If this option is not selected, no restrictions will be enforced 17 unless the dmesg_restrict sysctl is explicitly set to (1). 18 19 If you are unsure how to answer this question, answer N. 20 21config SECURITY_PERF_EVENTS_RESTRICT 22 bool "Restrict unprivileged use of performance events" 23 depends on PERF_EVENTS 24 help 25 If you say Y here, the kernel.perf_event_paranoid sysctl 26 will be set to 3 by default, and no unprivileged use of the 27 perf_event_open syscall will be permitted unless it is 28 changed. 29 30config SECURITY 31 bool "Enable different security models" 32 depends on SYSFS 33 depends on MULTIUSER 34 help 35 This allows you to choose different security modules to be 36 configured into your kernel. 37 38 If this option is not selected, the default Linux security 39 model will be used. 40 41 If you are unsure how to answer this question, answer N. 42 43config PAGE_TABLE_ISOLATION 44 bool "Remove the kernel mapping in user mode" 45 default y 46 depends on X86_64 && SMP 47 help 48 This enforces a strict kernel and user space isolation, in order 49 to close hardware side channels on kernel address information. 50 51 If you are unsure how to answer this question, answer Y. 52 53config SECURITYFS 54 bool "Enable the securityfs filesystem" 55 help 56 This will build the securityfs filesystem. It is currently used by 57 the TPM bios character driver and IMA, an integrity provider. It is 58 not used by SELinux or SMACK. 59 60 If you are unsure how to answer this question, answer N. 61 62config SECURITY_NETWORK 63 bool "Socket and Networking Security Hooks" 64 depends on SECURITY 65 help 66 This enables the socket and networking security hooks. 67 If enabled, a security module can use these hooks to 68 implement socket and networking access controls. 69 If you are unsure how to answer this question, answer N. 70 71config SECURITY_NETWORK_XFRM 72 bool "XFRM (IPSec) Networking Security Hooks" 73 depends on XFRM && SECURITY_NETWORK 74 help 75 This enables the XFRM (IPSec) networking security hooks. 76 If enabled, a security module can use these hooks to 77 implement per-packet access controls based on labels 78 derived from IPSec policy. Non-IPSec communications are 79 designated as unlabelled, and only sockets authorized 80 to communicate unlabelled data can send without using 81 IPSec. 82 If you are unsure how to answer this question, answer N. 83 84config SECURITY_PATH 85 bool "Security hooks for pathname based access control" 86 depends on SECURITY 87 help 88 This enables the security hooks for pathname based access control. 89 If enabled, a security module can use these hooks to 90 implement pathname based access controls. 91 If you are unsure how to answer this question, answer N. 92 93config INTEL_TXT 94 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)" 95 depends on HAVE_INTEL_TXT 96 help 97 This option enables support for booting the kernel with the 98 Trusted Boot (tboot) module. This will utilize 99 Intel(R) Trusted Execution Technology to perform a measured launch 100 of the kernel. If the system does not support Intel(R) TXT, this 101 will have no effect. 102 103 Intel TXT will provide higher assurance of system configuration and 104 initial state as well as data reset protection. This is used to 105 create a robust initial kernel measurement and verification, which 106 helps to ensure that kernel security mechanisms are functioning 107 correctly. This level of protection requires a root of trust outside 108 of the kernel itself. 109 110 Intel TXT also helps solve real end user concerns about having 111 confidence that their hardware is running the VMM or kernel that 112 it was configured with, especially since they may be responsible for 113 providing such assurances to VMs and services running on it. 114 115 See <http://www.intel.com/technology/security/> for more information 116 about Intel(R) TXT. 117 See <http://tboot.sourceforge.net> for more information about tboot. 118 See Documentation/intel_txt.txt for a description of how to enable 119 Intel TXT support in a kernel boot. 120 121 If you are unsure as to whether this is required, answer N. 122 123config LSM_MMAP_MIN_ADDR 124 int "Low address space for LSM to protect from user allocation" 125 depends on SECURITY && SECURITY_SELINUX 126 default 32768 if ARM || (ARM64 && COMPAT) 127 default 65536 128 help 129 This is the portion of low virtual memory which should be protected 130 from userspace allocation. Keeping a user from writing to low pages 131 can help reduce the impact of kernel NULL pointer bugs. 132 133 For most ia64, ppc64 and x86 users with lots of address space 134 a value of 65536 is reasonable and should cause no problems. 135 On arm and other archs it should not be higher than 32768. 136 Programs which use vm86 functionality or have some need to map 137 this low address space will need the permission specific to the 138 systems running LSM. 139 140config HAVE_HARDENED_USERCOPY_ALLOCATOR 141 bool 142 help 143 The heap allocator implements __check_heap_object() for 144 validating memory ranges against heap object sizes in 145 support of CONFIG_HARDENED_USERCOPY. 146 147config HAVE_ARCH_HARDENED_USERCOPY 148 bool 149 help 150 The architecture supports CONFIG_HARDENED_USERCOPY by 151 calling check_object_size() just before performing the 152 userspace copies in the low level implementation of 153 copy_to_user() and copy_from_user(). 154 155config HARDENED_USERCOPY 156 bool "Harden memory copies between kernel and userspace" 157 depends on HAVE_ARCH_HARDENED_USERCOPY 158 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR 159 select BUG 160 help 161 This option checks for obviously wrong memory regions when 162 copying memory to/from the kernel (via copy_to_user() and 163 copy_from_user() functions) by rejecting memory ranges that 164 are larger than the specified heap object, span multiple 165 separately allocates pages, are not on the process stack, 166 or are part of the kernel text. This kills entire classes 167 of heap overflow exploits and similar kernel memory exposures. 168 169config HARDENED_USERCOPY_PAGESPAN 170 bool "Refuse to copy allocations that span multiple pages" 171 depends on HARDENED_USERCOPY 172 depends on !COMPILE_TEST 173 help 174 When a multi-page allocation is done without __GFP_COMP, 175 hardened usercopy will reject attempts to copy it. There are, 176 however, several cases of this in the kernel that have not all 177 been removed. This config is intended to be used only while 178 trying to find such users. 179 180source security/selinux/Kconfig 181source security/smack/Kconfig 182source security/tomoyo/Kconfig 183source security/apparmor/Kconfig 184source security/yama/Kconfig 185 186source security/integrity/Kconfig 187 188choice 189 prompt "Default security module" 190 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX 191 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK 192 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO 193 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR 194 default DEFAULT_SECURITY_DAC 195 196 help 197 Select the security module that will be used by default if the 198 kernel parameter security= is not specified. 199 200 config DEFAULT_SECURITY_SELINUX 201 bool "SELinux" if SECURITY_SELINUX=y 202 203 config DEFAULT_SECURITY_SMACK 204 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y 205 206 config DEFAULT_SECURITY_TOMOYO 207 bool "TOMOYO" if SECURITY_TOMOYO=y 208 209 config DEFAULT_SECURITY_APPARMOR 210 bool "AppArmor" if SECURITY_APPARMOR=y 211 212 config DEFAULT_SECURITY_DAC 213 bool "Unix Discretionary Access Controls" 214 215endchoice 216 217config DEFAULT_SECURITY 218 string 219 default "selinux" if DEFAULT_SECURITY_SELINUX 220 default "smack" if DEFAULT_SECURITY_SMACK 221 default "tomoyo" if DEFAULT_SECURITY_TOMOYO 222 default "apparmor" if DEFAULT_SECURITY_APPARMOR 223 default "" if DEFAULT_SECURITY_DAC 224 225endmenu 226 227