path: root/security/Kconfig (plain)
blob: 80a2934d3110881cfc11fd4fd74336f9a2104a50

1	#
2	# Security configuration
3	#
4
5	menu "Security options"
6
7	source security/keys/Kconfig
8
9	config SECURITY_DMESG_RESTRICT
10	bool "Restrict unprivileged access to the kernel syslog"
11	default n
12	help
13	This enforces restrictions on unprivileged users reading the kernel
14	syslog via dmesg(8).
15
16	If this option is not selected, no restrictions will be enforced
17	unless the dmesg_restrict sysctl is explicitly set to (1).
18
19	If you are unsure how to answer this question, answer N.
20
21	config SECURITY_PERF_EVENTS_RESTRICT
22	bool "Restrict unprivileged use of performance events"
23	depends on PERF_EVENTS
24	help
25	If you say Y here, the kernel.perf_event_paranoid sysctl
26	will be set to 3 by default, and no unprivileged use of the
27	perf_event_open syscall will be permitted unless it is
28	changed.
29
30	config SECURITY
31	bool "Enable different security models"
32	depends on SYSFS
33	depends on MULTIUSER
34	help
35	This allows you to choose different security modules to be
36	configured into your kernel.
37
38	If this option is not selected, the default Linux security
39	model will be used.
40
41	If you are unsure how to answer this question, answer N.
42
43	config PAGE_TABLE_ISOLATION
44	bool "Remove the kernel mapping in user mode"
45	default y
46	depends on X86_64 && SMP
47	help
48	This enforces a strict kernel and user space isolation, in order
49	to close hardware side channels on kernel address information.
50
51	If you are unsure how to answer this question, answer Y.
52
53	config SECURITYFS
54	bool "Enable the securityfs filesystem"
55	help
56	This will build the securityfs filesystem. It is currently used by
57	the TPM bios character driver and IMA, an integrity provider. It is
58	not used by SELinux or SMACK.
59
60	If you are unsure how to answer this question, answer N.
61
62	config SECURITY_NETWORK
63	bool "Socket and Networking Security Hooks"
64	depends on SECURITY
65	help
66	This enables the socket and networking security hooks.
67	If enabled, a security module can use these hooks to
68	implement socket and networking access controls.
69	If you are unsure how to answer this question, answer N.
70
71	config SECURITY_NETWORK_XFRM
72	bool "XFRM (IPSec) Networking Security Hooks"
73	depends on XFRM && SECURITY_NETWORK
74	help
75	This enables the XFRM (IPSec) networking security hooks.
76	If enabled, a security module can use these hooks to
77	implement per-packet access controls based on labels
78	derived from IPSec policy. Non-IPSec communications are
79	designated as unlabelled, and only sockets authorized
80	to communicate unlabelled data can send without using
81	IPSec.
82	If you are unsure how to answer this question, answer N.
83
84	config SECURITY_PATH
85	bool "Security hooks for pathname based access control"
86	depends on SECURITY
87	help
88	This enables the security hooks for pathname based access control.
89	If enabled, a security module can use these hooks to
90	implement pathname based access controls.
91	If you are unsure how to answer this question, answer N.
92
93	config INTEL_TXT
94	bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
95	depends on HAVE_INTEL_TXT
96	help
97	This option enables support for booting the kernel with the
98	Trusted Boot (tboot) module. This will utilize
99	Intel(R) Trusted Execution Technology to perform a measured launch
100	of the kernel. If the system does not support Intel(R) TXT, this
101	will have no effect.
102
103	Intel TXT will provide higher assurance of system configuration and
104	initial state as well as data reset protection. This is used to
105	create a robust initial kernel measurement and verification, which
106	helps to ensure that kernel security mechanisms are functioning
107	correctly. This level of protection requires a root of trust outside
108	of the kernel itself.
109
110	Intel TXT also helps solve real end user concerns about having
111	confidence that their hardware is running the VMM or kernel that
112	it was configured with, especially since they may be responsible for
113	providing such assurances to VMs and services running on it.
114
115	See <http://www.intel.com/technology/security/> for more information
116	about Intel(R) TXT.
117	See <http://tboot.sourceforge.net> for more information about tboot.
118	See Documentation/intel_txt.txt for a description of how to enable
119	Intel TXT support in a kernel boot.
120
121	If you are unsure as to whether this is required, answer N.
122
123	config LSM_MMAP_MIN_ADDR
124	int "Low address space for LSM to protect from user allocation"
125	depends on SECURITY && SECURITY_SELINUX
126	default 32768 if ARM || (ARM64 && COMPAT)
127	default 65536
128	help
129	This is the portion of low virtual memory which should be protected
130	from userspace allocation. Keeping a user from writing to low pages
131	can help reduce the impact of kernel NULL pointer bugs.
132
133	For most ia64, ppc64 and x86 users with lots of address space
134	a value of 65536 is reasonable and should cause no problems.
135	On arm and other archs it should not be higher than 32768.
136	Programs which use vm86 functionality or have some need to map
137	this low address space will need the permission specific to the
138	systems running LSM.
139
140	config HAVE_HARDENED_USERCOPY_ALLOCATOR
141	bool
142	help
143	The heap allocator implements __check_heap_object() for
144	validating memory ranges against heap object sizes in
145	support of CONFIG_HARDENED_USERCOPY.
146
147	config HAVE_ARCH_HARDENED_USERCOPY
148	bool
149	help
150	The architecture supports CONFIG_HARDENED_USERCOPY by
151	calling check_object_size() just before performing the
152	userspace copies in the low level implementation of
153	copy_to_user() and copy_from_user().
154
155	config HARDENED_USERCOPY
156	bool "Harden memory copies between kernel and userspace"
157	depends on HAVE_ARCH_HARDENED_USERCOPY
158	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
159	select BUG
160	help
161	This option checks for obviously wrong memory regions when
162	copying memory to/from the kernel (via copy_to_user() and
163	copy_from_user() functions) by rejecting memory ranges that
164	are larger than the specified heap object, span multiple
165	separately allocates pages, are not on the process stack,
166	or are part of the kernel text. This kills entire classes
167	of heap overflow exploits and similar kernel memory exposures.
168
169	config HARDENED_USERCOPY_PAGESPAN
170	bool "Refuse to copy allocations that span multiple pages"
171	depends on HARDENED_USERCOPY
172	depends on EXPERT
173	help
174	When a multi-page allocation is done without __GFP_COMP,
175	hardened usercopy will reject attempts to copy it. There are,
176	however, several cases of this in the kernel that have not all
177	been removed. This config is intended to be used only while
178	trying to find such users.
179
180	source security/selinux/Kconfig
181	source security/smack/Kconfig
182	source security/tomoyo/Kconfig
183	source security/apparmor/Kconfig
184	source security/loadpin/Kconfig
185	source security/yama/Kconfig
186
187	source security/integrity/Kconfig
188
189	choice
190	prompt "Default security module"
191	default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
192	default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
193	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
194	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
195	default DEFAULT_SECURITY_DAC
196
197	help
198	Select the security module that will be used by default if the
199	kernel parameter security= is not specified.
200
201	config DEFAULT_SECURITY_SELINUX
202	bool "SELinux" if SECURITY_SELINUX=y
203
204	config DEFAULT_SECURITY_SMACK
205	bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
206
207	config DEFAULT_SECURITY_TOMOYO
208	bool "TOMOYO" if SECURITY_TOMOYO=y
209
210	config DEFAULT_SECURITY_APPARMOR
211	bool "AppArmor" if SECURITY_APPARMOR=y
212
213	config DEFAULT_SECURITY_DAC
214	bool "Unix Discretionary Access Controls"
215
216	endchoice
217
218	config DEFAULT_SECURITY
219	string
220	default "selinux" if DEFAULT_SECURITY_SELINUX
221	default "smack" if DEFAULT_SECURITY_SMACK
222	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
223	default "apparmor" if DEFAULT_SECURITY_APPARMOR
224	default "" if DEFAULT_SECURITY_DAC
225
226	endmenu
227
228