2019-05-19 13:07:45 +01:00
|
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
2005-04-16 15:20:36 -07:00
|
|
|
#
|
|
|
|
|
# Security configuration
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
menu "Security options"
|
|
|
|
|
|
2018-12-11 20:01:04 +09:00
|
|
|
source "security/keys/Kconfig"
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2010-11-11 14:05:18 -08:00
|
|
|
config SECURITY_DMESG_RESTRICT
|
|
|
|
|
bool "Restrict unprivileged access to the kernel syslog"
|
|
|
|
|
default n
|
|
|
|
|
help
|
|
|
|
|
This enforces restrictions on unprivileged users reading the kernel
|
|
|
|
|
syslog via dmesg(8).
|
|
|
|
|
|
|
|
|
|
If this option is not selected, no restrictions will be enforced
|
|
|
|
|
unless the dmesg_restrict sysctl is explicitly set to (1).
|
|
|
|
|
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
|
|
2024-08-02 11:02:25 +03:00
|
|
|
choice
|
|
|
|
|
prompt "Allow /proc/pid/mem access override"
|
|
|
|
|
default PROC_MEM_ALWAYS_FORCE
|
|
|
|
|
help
|
|
|
|
|
Traditionally /proc/pid/mem allows users to override memory
|
|
|
|
|
permissions for users like ptrace, assuming they have ptrace
|
|
|
|
|
capability.
|
|
|
|
|
|
|
|
|
|
This allows people to limit that - either never override, or
|
|
|
|
|
require actual active ptrace attachment.
|
|
|
|
|
|
|
|
|
|
Defaults to the traditional behavior (for now)
|
|
|
|
|
|
|
|
|
|
config PROC_MEM_ALWAYS_FORCE
|
|
|
|
|
bool "Traditional /proc/pid/mem behavior"
|
|
|
|
|
help
|
|
|
|
|
This allows /proc/pid/mem accesses to override memory mapping
|
|
|
|
|
permissions if you have ptrace access rights.
|
|
|
|
|
|
|
|
|
|
config PROC_MEM_FORCE_PTRACE
|
|
|
|
|
bool "Require active ptrace() use for access override"
|
|
|
|
|
help
|
|
|
|
|
This allows /proc/pid/mem accesses to override memory mapping
|
|
|
|
|
permissions for active ptracers like gdb.
|
|
|
|
|
|
|
|
|
|
config PROC_MEM_NO_FORCE
|
|
|
|
|
bool "Never"
|
|
|
|
|
help
|
|
|
|
|
Never override memory mapping permissions
|
|
|
|
|
|
|
|
|
|
endchoice
|
|
|
|
|
|
mseal sysmap: kernel config and header change
Patch series "mseal system mappings", v9.
As discussed during mseal() upstream process [1], mseal() protects the
VMAs of a given virtual memory range against modifications, such as the
read/write (RW) and no-execute (NX) bits. For complete descriptions of
memory sealing, please see mseal.rst [2].
The mseal() is useful to mitigate memory corruption issues where a
corrupted pointer is passed to a memory management system. For example,
such an attacker primitive can break control-flow integrity guarantees
since read-only memory that is supposed to be trusted can become writable
or .text pages can get remapped.
The system mappings are readonly only, memory sealing can protect them
from ever changing to writable or unmmap/remapped as different attributes.
System mappings such as vdso, vvar, vvar_vclock, vectors (arm
compat-mode), sigpage (arm compat-mode), are created by the kernel during
program initialization, and could be sealed after creation.
Unlike the aforementioned mappings, the uprobe mapping is not established
during program startup. However, its lifetime is the same as the
process's lifetime [3]. It could be sealed from creation.
The vsyscall on x86-64 uses a special address (0xffffffffff600000), which
is outside the mm managed range. This means mprotect, munmap, and mremap
won't work on the vsyscall. Since sealing doesn't enhance the vsyscall's
security, it is skipped in this patch. If we ever seal the vsyscall, it
is probably only for decorative purpose, i.e. showing the 'sl' flag in
the /proc/pid/smaps. For this patch, it is ignored.
It is important to note that the CHECKPOINT_RESTORE feature (CRIU) may
alter the system mappings during restore operations. UML(User Mode Linux)
and gVisor, rr are also known to change the vdso/vvar mappings.
Consequently, this feature cannot be universally enabled across all
systems. As such, CONFIG_MSEAL_SYSTEM_MAPPINGS is disabled by default.
To support mseal of system mappings, architectures must define
CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS and update their special
mappings calls to pass mseal flag. Additionally, architectures must
confirm they do not unmap/remap system mappings during the process
lifetime. The existence of this flag for an architecture implies that it
does not require the remapping of thest system mappings during process
lifetime, so sealing these mappings is safe from a kernel perspective.
This version covers x86-64 and arm64 archiecture as minimum viable feature.
While no specific CPU hardware features are required for enable this
feature on an archiecture, memory sealing requires a 64-bit kernel. Other
architectures can choose whether or not to adopt this feature. Currently,
I'm not aware of any instances in the kernel code that actively
munmap/mremap a system mapping without a request from userspace. The PPC
does call munmap when _install_special_mapping fails for vdso; however,
it's uncertain if this will ever fail for PPC - this needs to be
investigated by PPC in the future [4]. The UML kernel can add this
support when KUnit tests require it [5].
In this version, we've improved the handling of system mapping sealing
from previous versions, instead of modifying the _install_special_mapping
function itself, which would affect all architectures, we now call
_install_special_mapping with a sealing flag only within the specific
architecture that requires it. This targeted approach offers two key
advantages: 1) It limits the code change's impact to the necessary
architectures, and 2) It aligns with the software architecture by keeping
the core memory management within the mm layer, while delegating the
decision of sealing system mappings to the individual architecture, which
is particularly relevant since 32-bit architectures never require sealing.
Prior to this patch series, we explored sealing special mappings from
userspace using glibc's dynamic linker. This approach revealed several
issues:
- The PT_LOAD header may report an incorrect length for vdso, (smaller
than its actual size). The dynamic linker, which relies on PT_LOAD
information to determine mapping size, would then split and partially
seal the vdso mapping. Since each architecture has its own vdso/vvar
code, fixing this in the kernel would require going through each
archiecture. Our initial goal was to enable sealing readonly mappings,
e.g. .text, across all architectures, sealing vdso from kernel since
creation appears to be simpler than sealing vdso at glibc.
- The [vvar] mapping header only contains address information, not
length information. Similar issues might exist for other special
mappings.
- Mappings like uprobe are not covered by the dynamic linker, and there
is no effective solution for them.
This feature's security enhancements will benefit ChromeOS, Android, and
other high security systems.
Testing:
This feature was tested on ChromeOS and Android for both x86-64 and ARM64.
- Enable sealing and verify vdso/vvar, sigpage, vector are sealed properly,
i.e. "sl" shown in the smaps for those mappings, and mremap is blocked.
- Passing various automation tests (e.g. pre-checkin) on ChromeOS and
Android to ensure the sealing doesn't affect the functionality of
Chromebook and Android phone.
I also tested the feature on Ubuntu on x86-64:
- With config disabled, vdso/vvar is not sealed,
- with config enabled, vdso/vvar is sealed, and booting up Ubuntu is OK,
normal operations such as browsing the web, open/edit doc are OK.
Link: https://lore.kernel.org/all/20240415163527.626541-1-jeffxu@chromium.org/ [1]
Link: Documentation/userspace-api/mseal.rst [2]
Link: https://lore.kernel.org/all/CABi2SkU9BRUnqf70-nksuMCQ+yyiWjo3fM4XkRkL-NrCZxYAyg@mail.gmail.com/ [3]
Link: https://lore.kernel.org/all/CABi2SkV6JJwJeviDLsq9N4ONvQ=EFANsiWkgiEOjyT9TQSt+HA@mail.gmail.com/ [4]
Link: https://lore.kernel.org/all/202502251035.239B85A93@keescook/ [5]
This patch (of 7):
Provide infrastructure to mseal system mappings. Establish two kernel
configs (CONFIG_MSEAL_SYSTEM_MAPPINGS,
ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS) and VM_SEALED_SYSMAP macro for future
patches.
Link: https://lkml.kernel.org/r/20250305021711.3867874-1-jeffxu@google.com
Link: https://lkml.kernel.org/r/20250305021711.3867874-2-jeffxu@google.com
Signed-off-by: Jeff Xu <jeffxu@chromium.org>
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Anna-Maria Behnsen <anna-maria@linutronix.de>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Benjamin Berg <benjamin@sipsolutions.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Rientjes <rientjes@google.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Elliot Hughes <enh@google.com>
Cc: Florian Faineli <f.fainelli@gmail.com>
Cc: Greg Ungerer <gerg@kernel.org>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jason A. Donenfeld <jason@zx2c4.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Jorge Lucangeli Obes <jorgelo@chromium.org>
Cc: Linus Waleij <linus.walleij@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Mike Rapoport <mike.rapoport@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Stephen Röttger <sroettger@google.com>
Cc: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-03-05 02:17:05 +00:00
|
|
|
config MSEAL_SYSTEM_MAPPINGS
|
|
|
|
|
bool "mseal system mappings"
|
|
|
|
|
depends on 64BIT
|
|
|
|
|
depends on ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS
|
|
|
|
|
depends on !CHECKPOINT_RESTORE
|
|
|
|
|
help
|
|
|
|
|
Apply mseal on system mappings.
|
|
|
|
|
The system mappings includes vdso, vvar, vvar_vclock,
|
|
|
|
|
vectors (arm compat-mode), sigpage (arm compat-mode), uprobes.
|
|
|
|
|
|
|
|
|
|
A 64-bit kernel is required for the memory sealing feature.
|
|
|
|
|
No specific hardware features from the CPU are needed.
|
|
|
|
|
|
|
|
|
|
WARNING: This feature breaks programs which rely on relocating
|
|
|
|
|
or unmapping system mappings. Known broken software at the time
|
|
|
|
|
of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr. Therefore
|
|
|
|
|
this config can't be enabled universally.
|
|
|
|
|
|
|
|
|
|
For complete descriptions of memory sealing, please see
|
|
|
|
|
Documentation/userspace-api/mseal.rst
|
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
config SECURITY
|
|
|
|
|
bool "Enable different security models"
|
2005-08-22 18:20:50 +02:00
|
|
|
depends on SYSFS
|
kernel: conditionally support non-root users, groups and capabilities
There are a lot of embedded systems that run most or all of their
functionality in init, running as root:root. For these systems,
supporting multiple users is not necessary.
This patch adds a new symbol, CONFIG_MULTIUSER, that makes support for
non-root users, non-root groups, and capabilities optional. It is enabled
under CONFIG_EXPERT menu.
When this symbol is not defined, UID and GID are zero in any possible case
and processes always have all capabilities.
The following syscalls are compiled out: setuid, setregid, setgid,
setreuid, setresuid, getresuid, setresgid, getresgid, setgroups,
getgroups, setfsuid, setfsgid, capget, capset.
Also, groups.c is compiled out completely.
In kernel/capability.c, capable function was moved in order to avoid
adding two ifdef blocks.
This change saves about 25 KB on a defconfig build. The most minimal
kernels have total text sizes in the high hundreds of kB rather than
low MB. (The 25k goes down a bit with allnoconfig, but not that much.
The kernel was booted in Qemu. All the common functionalities work.
Adding users/groups is not possible, failing with -ENOSYS.
Bloat-o-meter output:
add/remove: 7/87 grow/shrink: 19/397 up/down: 1675/-26325 (-24650)
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Iulia Manda <iulia.manda21@gmail.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-04-15 16:16:41 -07:00
|
|
|
depends on MULTIUSER
|
2005-04-16 15:20:36 -07:00
|
|
|
help
|
|
|
|
|
This allows you to choose different security modules to be
|
|
|
|
|
configured into your kernel.
|
|
|
|
|
|
|
|
|
|
If this option is not selected, the default Linux security
|
|
|
|
|
model will be used.
|
|
|
|
|
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
|
|
2024-11-22 15:33:31 +01:00
|
|
|
config HAS_SECURITY_AUDIT
|
|
|
|
|
def_bool y
|
|
|
|
|
depends on AUDIT
|
|
|
|
|
depends on SECURITY
|
|
|
|
|
|
2008-08-22 11:35:57 -04:00
|
|
|
config SECURITYFS
|
|
|
|
|
bool "Enable the securityfs filesystem"
|
|
|
|
|
help
|
|
|
|
|
This will build the securityfs filesystem. It is currently used by
|
2019-03-01 00:54:48 +01:00
|
|
|
various security modules (AppArmor, IMA, SafeSetID, TOMOYO, TPM).
|
2008-08-22 11:35:57 -04:00
|
|
|
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
config SECURITY_NETWORK
|
|
|
|
|
bool "Socket and Networking Security Hooks"
|
|
|
|
|
depends on SECURITY
|
|
|
|
|
help
|
|
|
|
|
This enables the socket and networking security hooks.
|
|
|
|
|
If enabled, a security module can use these hooks to
|
|
|
|
|
implement socket and networking access controls.
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-13 23:12:27 -08:00
|
|
|
|
IB/core: Enforce PKey security on QPs
Add new LSM hooks to allocate and free security contexts and check for
permission to access a PKey.
Allocate and free a security context when creating and destroying a QP.
This context is used for controlling access to PKeys.
When a request is made to modify a QP that changes the port, PKey index,
or alternate path, check that the QP has permission for the PKey in the
PKey table index on the subnet prefix of the port. If the QP is shared
make sure all handles to the QP also have access.
Store which port and PKey index a QP is using. After the reset to init
transition the user can modify the port, PKey index and alternate path
independently. So port and PKey settings changes can be a merge of the
previous settings and the new ones.
In order to maintain access control if there are PKey table or subnet
prefix change keep a list of all QPs are using each PKey index on
each port. If a change occurs all QPs using that device and port must
have access enforced for the new cache settings.
These changes add a transaction to the QP modify process. Association
with the old port and PKey index must be maintained if the modify fails,
and must be removed if it succeeds. Association with the new port and
PKey index must be established prior to the modify and removed if the
modify fails.
1. When a QP is modified to a particular Port, PKey index or alternate
path insert that QP into the appropriate lists.
2. Check permission to access the new settings.
3. If step 2 grants access attempt to modify the QP.
4a. If steps 2 and 3 succeed remove any prior associations.
4b. If ether fails remove the new setting associations.
If a PKey table or subnet prefix changes walk the list of QPs and
check that they have permission. If not send the QP to the error state
and raise a fatal error event. If it's a shared QP make sure all the
QPs that share the real_qp have permission as well. If the QP that
owns a security structure is denied access the security structure is
marked as such and the QP is added to an error_list. Once the moving
the QP to error is complete the security structure mark is cleared.
Maintaining the lists correctly turns QP destroy into a transaction.
The hardware driver for the device frees the ib_qp structure, so while
the destroy is in progress the ib_qp pointer in the ib_qp_security
struct is undefined. When the destroy process begins the ib_qp_security
structure is marked as destroying. This prevents any action from being
taken on the QP pointer. After the QP is destroyed successfully it
could still listed on an error_list wait for it to be processed by that
flow before cleaning up the structure.
If the destroy fails the QPs port and PKey settings are reinserted into
the appropriate lists, the destroying flag is cleared, and access control
is enforced, in case there were any cache changes during the destroy
flow.
To keep the security changes isolated a new file is used to hold security
related functionality.
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Acked-by: Doug Ledford <dledford@redhat.com>
[PM: merge fixup in ib_verbs.h and uverbs_cmd.c]
Signed-off-by: Paul Moore <paul@paul-moore.com>
2017-05-19 15:48:52 +03:00
|
|
|
config SECURITY_INFINIBAND
|
|
|
|
|
bool "Infiniband Security Hooks"
|
|
|
|
|
depends on SECURITY && INFINIBAND
|
|
|
|
|
help
|
|
|
|
|
This enables the Infiniband security hooks.
|
|
|
|
|
If enabled, a security module can use these hooks to
|
|
|
|
|
implement Infiniband access controls.
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
|
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-13 23:12:27 -08:00
|
|
|
config SECURITY_NETWORK_XFRM
|
|
|
|
|
bool "XFRM (IPSec) Networking Security Hooks"
|
|
|
|
|
depends on XFRM && SECURITY_NETWORK
|
|
|
|
|
help
|
|
|
|
|
This enables the XFRM (IPSec) networking security hooks.
|
|
|
|
|
If enabled, a security module can use these hooks to
|
|
|
|
|
implement per-packet access controls based on labels
|
|
|
|
|
derived from IPSec policy. Non-IPSec communications are
|
|
|
|
|
designated as unlabelled, and only sockets authorized
|
|
|
|
|
to communicate unlabelled data can send without using
|
|
|
|
|
IPSec.
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2008-12-17 13:24:15 +09:00
|
|
|
config SECURITY_PATH
|
|
|
|
|
bool "Security hooks for pathname based access control"
|
|
|
|
|
depends on SECURITY
|
|
|
|
|
help
|
|
|
|
|
This enables the security hooks for pathname based access control.
|
|
|
|
|
If enabled, a security module can use these hooks to
|
|
|
|
|
implement pathname based access controls.
|
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
|
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
config INTEL_TXT
|
|
|
|
|
bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
|
2009-09-01 18:25:07 -07:00
|
|
|
depends on HAVE_INTEL_TXT
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
help
|
|
|
|
|
This option enables support for booting the kernel with the
|
|
|
|
|
Trusted Boot (tboot) module. This will utilize
|
|
|
|
|
Intel(R) Trusted Execution Technology to perform a measured launch
|
|
|
|
|
of the kernel. If the system does not support Intel(R) TXT, this
|
|
|
|
|
will have no effect.
|
|
|
|
|
|
2009-08-12 12:00:40 -03:00
|
|
|
Intel TXT will provide higher assurance of system configuration and
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
initial state as well as data reset protection. This is used to
|
|
|
|
|
create a robust initial kernel measurement and verification, which
|
|
|
|
|
helps to ensure that kernel security mechanisms are functioning
|
|
|
|
|
correctly. This level of protection requires a root of trust outside
|
|
|
|
|
of the kernel itself.
|
|
|
|
|
|
|
|
|
|
Intel TXT also helps solve real end user concerns about having
|
|
|
|
|
confidence that their hardware is running the VMM or kernel that
|
2009-08-12 12:00:40 -03:00
|
|
|
it was configured with, especially since they may be responsible for
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
providing such assurances to VMs and services running on it.
|
|
|
|
|
|
2020-07-05 23:45:12 +02:00
|
|
|
See <https://www.intel.com/technology/security/> for more information
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
about Intel(R) TXT.
|
|
|
|
|
See <http://tboot.sourceforge.net> for more information about tboot.
|
2023-03-14 17:06:44 -06:00
|
|
|
See Documentation/arch/x86/intel_txt.rst for a description of how to enable
|
x86, intel_txt: Intel TXT boot support
This patch adds kernel configuration and boot support for Intel Trusted
Execution Technology (Intel TXT).
Intel's technology for safer computing, Intel Trusted Execution
Technology (Intel TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.
Intel TXT was formerly known by the code name LaGrande Technology (LT).
Intel TXT in Brief:
o Provides dynamic root of trust for measurement (DRTM)
o Data protection in case of improper shutdown
o Measurement and verification of launched environment
Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems. It is currently available on desktop systems based on
the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell Optiplex 755, HP
dc7800, etc.) and mobile systems based on the GM45, PM45, and GS45
Express chipsets.
For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual, which
has been updated for the new released platforms.
A much more complete description of how these patches support TXT, how to
configure a system for it, etc. is in the Documentation/intel_txt.txt file
in this patch.
This patch provides the TXT support routines for complete functionality,
documentation for TXT support and for the changes to the boot_params structure,
and boot detection of a TXT launch. Attempts to shutdown (reboot, Sx) the system
will result in platform resets; subsequent patches will support these shutdown modes
properly.
Documentation/intel_txt.txt | 210 +++++++++++++++++++++
Documentation/x86/zero-page.txt | 1
arch/x86/include/asm/bootparam.h | 3
arch/x86/include/asm/fixmap.h | 3
arch/x86/include/asm/tboot.h | 197 ++++++++++++++++++++
arch/x86/kernel/Makefile | 1
arch/x86/kernel/setup.c | 4
arch/x86/kernel/tboot.c | 379 +++++++++++++++++++++++++++++++++++++++
security/Kconfig | 30 +++
9 files changed, 827 insertions(+), 1 deletion(-)
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Gang Wei <gang.wei@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-06-30 19:30:59 -07:00
|
|
|
Intel TXT support in a kernel boot.
|
|
|
|
|
|
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
|
|
2009-07-31 12:54:11 -04:00
|
|
|
config LSM_MMAP_MIN_ADDR
|
2009-08-18 22:14:29 +02:00
|
|
|
int "Low address space for LSM to protect from user allocation"
|
2009-07-31 12:54:11 -04:00
|
|
|
depends on SECURITY && SECURITY_SELINUX
|
2014-02-04 02:15:32 +00:00
|
|
|
default 32768 if ARM || (ARM64 && COMPAT)
|
2009-08-18 13:47:37 -04:00
|
|
|
default 65536
|
2009-07-31 12:54:11 -04:00
|
|
|
help
|
|
|
|
|
This is the portion of low virtual memory which should be protected
|
|
|
|
|
from userspace allocation. Keeping a user from writing to low pages
|
|
|
|
|
can help reduce the impact of kernel NULL pointer bugs.
|
|
|
|
|
|
|
|
|
|
For most ia64, ppc64 and x86 users with lots of address space
|
|
|
|
|
a value of 65536 is reasonable and should cause no problems.
|
|
|
|
|
On arm and other archs it should not be higher than 32768.
|
|
|
|
|
Programs which use vm86 functionality or have some need to map
|
|
|
|
|
this low address space will need the permission specific to the
|
|
|
|
|
systems running LSM.
|
|
|
|
|
|
2017-01-16 16:22:39 +01:00
|
|
|
config STATIC_USERMODEHELPER
|
|
|
|
|
bool "Force all usermode helper calls through a single binary"
|
|
|
|
|
help
|
|
|
|
|
By default, the kernel can call many different userspace
|
|
|
|
|
binary programs through the "usermode helper" kernel
|
|
|
|
|
interface. Some of these binaries are statically defined
|
|
|
|
|
either in the kernel code itself, or as a kernel configuration
|
|
|
|
|
option. However, some of these are dynamically created at
|
|
|
|
|
runtime, or can be modified after the kernel has started up.
|
|
|
|
|
To provide an additional layer of security, route all of these
|
|
|
|
|
calls through a single executable that can not have its name
|
|
|
|
|
changed.
|
|
|
|
|
|
|
|
|
|
Note, it is up to this single binary to then call the relevant
|
|
|
|
|
"real" usermode helper binary, based on the first argument
|
|
|
|
|
passed to it. If desired, this program can filter and pick
|
|
|
|
|
and choose what real programs are called.
|
|
|
|
|
|
|
|
|
|
If you wish for all usermode helper programs are to be
|
|
|
|
|
disabled, choose this option and then set
|
|
|
|
|
STATIC_USERMODEHELPER_PATH to an empty string.
|
|
|
|
|
|
|
|
|
|
config STATIC_USERMODEHELPER_PATH
|
|
|
|
|
string "Path to the static usermode helper binary"
|
|
|
|
|
depends on STATIC_USERMODEHELPER
|
|
|
|
|
default "/sbin/usermode-helper"
|
|
|
|
|
help
|
|
|
|
|
The binary called by the kernel when any usermode helper
|
|
|
|
|
program is wish to be run. The "real" application's name will
|
|
|
|
|
be in the first argument passed to this program on the command
|
|
|
|
|
line.
|
|
|
|
|
|
|
|
|
|
If you wish for all usermode helper programs to be disabled,
|
|
|
|
|
specify an empty string here (i.e. "").
|
|
|
|
|
|
2018-12-11 20:01:04 +09:00
|
|
|
source "security/selinux/Kconfig"
|
|
|
|
|
source "security/smack/Kconfig"
|
|
|
|
|
source "security/tomoyo/Kconfig"
|
|
|
|
|
source "security/apparmor/Kconfig"
|
|
|
|
|
source "security/loadpin/Kconfig"
|
|
|
|
|
source "security/yama/Kconfig"
|
2019-01-16 07:46:06 -08:00
|
|
|
source "security/safesetid/Kconfig"
|
2019-08-19 17:17:39 -07:00
|
|
|
source "security/lockdown/Kconfig"
|
2021-04-22 17:41:11 +02:00
|
|
|
source "security/landlock/Kconfig"
|
2024-08-02 23:08:15 -07:00
|
|
|
source "security/ipe/Kconfig"
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2018-12-11 20:01:04 +09:00
|
|
|
source "security/integrity/Kconfig"
|
2009-02-04 09:06:58 -05:00
|
|
|
|
2019-03-29 12:36:04 -07:00
|
|
|
choice
|
|
|
|
|
prompt "First legacy 'major LSM' to be initialized"
|
|
|
|
|
default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
|
|
|
|
|
default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
|
|
|
|
|
default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
|
|
|
|
|
default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
|
|
|
|
|
default DEFAULT_SECURITY_DAC
|
|
|
|
|
|
|
|
|
|
help
|
|
|
|
|
This choice is there only for converting CONFIG_DEFAULT_SECURITY
|
|
|
|
|
in old kernel configs to CONFIG_LSM in new kernel configs. Don't
|
|
|
|
|
change this choice unless you are creating a fresh kernel config,
|
|
|
|
|
for this choice will be ignored after CONFIG_LSM has been set.
|
|
|
|
|
|
|
|
|
|
Selects the legacy "major security module" that will be
|
|
|
|
|
initialized first. Overridden by non-default CONFIG_LSM.
|
|
|
|
|
|
|
|
|
|
config DEFAULT_SECURITY_SELINUX
|
|
|
|
|
bool "SELinux" if SECURITY_SELINUX=y
|
|
|
|
|
|
|
|
|
|
config DEFAULT_SECURITY_SMACK
|
|
|
|
|
bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
|
|
|
|
|
|
|
|
|
|
config DEFAULT_SECURITY_TOMOYO
|
|
|
|
|
bool "TOMOYO" if SECURITY_TOMOYO=y
|
|
|
|
|
|
|
|
|
|
config DEFAULT_SECURITY_APPARMOR
|
|
|
|
|
bool "AppArmor" if SECURITY_APPARMOR=y
|
|
|
|
|
|
|
|
|
|
config DEFAULT_SECURITY_DAC
|
|
|
|
|
bool "Unix Discretionary Access Controls"
|
|
|
|
|
|
|
|
|
|
endchoice
|
|
|
|
|
|
2018-10-09 14:27:46 -07:00
|
|
|
config LSM
|
|
|
|
|
string "Ordered list of enabled LSMs"
|
2024-08-02 23:08:15 -07:00
|
|
|
default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
|
|
|
|
|
default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
|
|
|
|
|
default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
|
|
|
|
|
default "landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" if DEFAULT_SECURITY_DAC
|
|
|
|
|
default "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
|
2018-10-09 14:27:46 -07:00
|
|
|
help
|
|
|
|
|
A comma-separated list of LSMs, in initialization order.
|
2023-03-10 09:54:01 +01:00
|
|
|
Any LSMs left off this list, except for those with order
|
|
|
|
|
LSM_ORDER_FIRST and LSM_ORDER_LAST, which are always enabled
|
|
|
|
|
if selected in the kernel configuration, will be ignored.
|
|
|
|
|
This can be controlled at boot with the "lsm=" parameter.
|
2018-10-09 14:27:46 -07:00
|
|
|
|
|
|
|
|
If unsure, leave this as the default.
|
|
|
|
|
|
2019-04-10 08:23:44 -07:00
|
|
|
source "security/Kconfig.hardening"
|
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
endmenu
|
|
|
|
|
|