linux/security/Kconfig
<<
>>
Prefs
   1#
   2# Security configuration
   3#
   4
   5menu "Security options"
   6
   7config KEYS
   8        bool "Enable access key retention support"
   9        help
  10          This option provides support for retaining authentication tokens and
  11          access keys in the kernel.
  12
  13          It also includes provision of methods by which such keys might be
  14          associated with a process so that network filesystems, encryption
  15          support and the like can find them.
  16
  17          Furthermore, a special type of key is available that acts as keyring:
  18          a searchable sequence of keys. Each process is equipped with access
  19          to five standard keyrings: UID-specific, GID-specific, session,
  20          process and thread.
  21
  22          If you are unsure as to whether this is required, answer N.
  23
  24config TRUSTED_KEYS
  25        tristate "TRUSTED KEYS"
  26        depends on KEYS && TCG_TPM
  27        select CRYPTO
  28        select CRYPTO_HMAC
  29        select CRYPTO_SHA1
  30        help
  31          This option provides support for creating, sealing, and unsealing
  32          keys in the kernel. Trusted keys are random number symmetric keys,
  33          generated and RSA-sealed by the TPM. The TPM only unseals the keys,
  34          if the boot PCRs and other criteria match.  Userspace will only ever
  35          see encrypted blobs.
  36
  37          If you are unsure as to whether this is required, answer N.
  38
  39config ENCRYPTED_KEYS
  40        tristate "ENCRYPTED KEYS"
  41        depends on KEYS && TRUSTED_KEYS
  42        select CRYPTO_AES
  43        select CRYPTO_CBC
  44        select CRYPTO_SHA256
  45        select CRYPTO_RNG
  46        help
  47          This option provides support for create/encrypting/decrypting keys
  48          in the kernel.  Encrypted keys are kernel generated random numbers,
  49          which are encrypted/decrypted with a 'master' symmetric key. The
  50          'master' key can be either a trusted-key or user-key type.
  51          Userspace only ever sees/stores encrypted blobs.
  52
  53          If you are unsure as to whether this is required, answer N.
  54
  55config KEYS_DEBUG_PROC_KEYS
  56        bool "Enable the /proc/keys file by which keys may be viewed"
  57        depends on KEYS
  58        help
  59          This option turns on support for the /proc/keys file - through which
  60          can be listed all the keys on the system that are viewable by the
  61          reading process.
  62
  63          The only keys included in the list are those that grant View
  64          permission to the reading process whether or not it possesses them.
  65          Note that LSM security checks are still performed, and may further
  66          filter out keys that the current process is not authorised to view.
  67
  68          Only key attributes are listed here; key payloads are not included in
  69          the resulting table.
  70
  71          If you are unsure as to whether this is required, answer N.
  72
  73config SECURITY_DMESG_RESTRICT
  74        bool "Restrict unprivileged access to the kernel syslog"
  75        default n
  76        help
  77          This enforces restrictions on unprivileged users reading the kernel
  78          syslog via dmesg(8).
  79
  80          If this option is not selected, no restrictions will be enforced
  81          unless the dmesg_restrict sysctl is explicitly set to (1).
  82
  83          If you are unsure how to answer this question, answer N.
  84
  85config SECURITY
  86        bool "Enable different security models"
  87        depends on SYSFS
  88        help
  89          This allows you to choose different security modules to be
  90          configured into your kernel.
  91
  92          If this option is not selected, the default Linux security
  93          model will be used.
  94
  95          If you are unsure how to answer this question, answer N.
  96
  97config SECURITYFS
  98        bool "Enable the securityfs filesystem"
  99        help
 100          This will build the securityfs filesystem.  It is currently used by
 101          the TPM bios character driver and IMA, an integrity provider.  It is
 102          not used by SELinux or SMACK.
 103
 104          If you are unsure how to answer this question, answer N.
 105
 106config SECURITY_NETWORK
 107        bool "Socket and Networking Security Hooks"
 108        depends on SECURITY
 109        help
 110          This enables the socket and networking security hooks.
 111          If enabled, a security module can use these hooks to
 112          implement socket and networking access controls.
 113          If you are unsure how to answer this question, answer N.
 114
 115config SECURITY_NETWORK_XFRM
 116        bool "XFRM (IPSec) Networking Security Hooks"
 117        depends on XFRM && SECURITY_NETWORK
 118        help
 119          This enables the XFRM (IPSec) networking security hooks.
 120          If enabled, a security module can use these hooks to
 121          implement per-packet access controls based on labels
 122          derived from IPSec policy.  Non-IPSec communications are
 123          designated as unlabelled, and only sockets authorized
 124          to communicate unlabelled data can send without using
 125          IPSec.
 126          If you are unsure how to answer this question, answer N.
 127
 128config SECURITY_PATH
 129        bool "Security hooks for pathname based access control"
 130        depends on SECURITY
 131        help
 132          This enables the security hooks for pathname based access control.
 133          If enabled, a security module can use these hooks to
 134          implement pathname based access controls.
 135          If you are unsure how to answer this question, answer N.
 136
 137config INTEL_TXT
 138        bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
 139        depends on HAVE_INTEL_TXT
 140        help
 141          This option enables support for booting the kernel with the
 142          Trusted Boot (tboot) module. This will utilize
 143          Intel(R) Trusted Execution Technology to perform a measured launch
 144          of the kernel. If the system does not support Intel(R) TXT, this
 145          will have no effect.
 146
 147          Intel TXT will provide higher assurance of system configuration and
 148          initial state as well as data reset protection.  This is used to
 149          create a robust initial kernel measurement and verification, which
 150          helps to ensure that kernel security mechanisms are functioning
 151          correctly. This level of protection requires a root of trust outside
 152          of the kernel itself.
 153
 154          Intel TXT also helps solve real end user concerns about having
 155          confidence that their hardware is running the VMM or kernel that
 156          it was configured with, especially since they may be responsible for
 157          providing such assurances to VMs and services running on it.
 158
 159          See <http://www.intel.com/technology/security/> for more information
 160          about Intel(R) TXT.
 161          See <http://tboot.sourceforge.net> for more information about tboot.
 162          See Documentation/intel_txt.txt for a description of how to enable
 163          Intel TXT support in a kernel boot.
 164
 165          If you are unsure as to whether this is required, answer N.
 166
 167config LSM_MMAP_MIN_ADDR
 168        int "Low address space for LSM to protect from user allocation"
 169        depends on SECURITY && SECURITY_SELINUX
 170        default 32768 if ARM
 171        default 65536
 172        help
 173          This is the portion of low virtual memory which should be protected
 174          from userspace allocation.  Keeping a user from writing to low pages
 175          can help reduce the impact of kernel NULL pointer bugs.
 176
 177          For most ia64, ppc64 and x86 users with lots of address space
 178          a value of 65536 is reasonable and should cause no problems.
 179          On arm and other archs it should not be higher than 32768.
 180          Programs which use vm86 functionality or have some need to map
 181          this low address space will need the permission specific to the
 182          systems running LSM.
 183
 184source security/selinux/Kconfig
 185source security/smack/Kconfig
 186source security/tomoyo/Kconfig
 187source security/apparmor/Kconfig
 188
 189source security/integrity/ima/Kconfig
 190
 191choice
 192        prompt "Default security module"
 193        default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
 194        default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
 195        default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
 196        default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
 197        default DEFAULT_SECURITY_DAC
 198
 199        help
 200          Select the security module that will be used by default if the
 201          kernel parameter security= is not specified.
 202
 203        config DEFAULT_SECURITY_SELINUX
 204                bool "SELinux" if SECURITY_SELINUX=y
 205
 206        config DEFAULT_SECURITY_SMACK
 207                bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
 208
 209        config DEFAULT_SECURITY_TOMOYO
 210                bool "TOMOYO" if SECURITY_TOMOYO=y
 211
 212        config DEFAULT_SECURITY_APPARMOR
 213                bool "AppArmor" if SECURITY_APPARMOR=y
 214
 215        config DEFAULT_SECURITY_DAC
 216                bool "Unix Discretionary Access Controls"
 217
 218endchoice
 219
 220config DEFAULT_SECURITY
 221        string
 222        default "selinux" if DEFAULT_SECURITY_SELINUX
 223        default "smack" if DEFAULT_SECURITY_SMACK
 224        default "tomoyo" if DEFAULT_SECURITY_TOMOYO
 225        default "apparmor" if DEFAULT_SECURITY_APPARMOR
 226        default "" if DEFAULT_SECURITY_DAC
 227
 228endmenu
 229
 230
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.