2 # Security configuration
5 menu "Security options"
7 source security/keys/Kconfig
10 source security/pfe/Kconfig
14 config SECURITY_DMESG_RESTRICT
15 bool "Restrict unprivileged access to the kernel syslog"
18 This enforces restrictions on unprivileged users reading the kernel
21 If this option is not selected, no restrictions will be enforced
22 unless the dmesg_restrict sysctl is explicitly set to (1).
24 If you are unsure how to answer this question, answer N.
26 config SECURITY_PERF_EVENTS_RESTRICT
27 bool "Restrict unprivileged use of performance events"
28 depends on PERF_EVENTS
30 If you say Y here, the kernel.perf_event_paranoid sysctl
31 will be set to 3 by default, and no unprivileged use of the
32 perf_event_open syscall will be permitted unless it is
36 bool "Enable different security models"
40 This allows you to choose different security modules to be
41 configured into your kernel.
43 If this option is not selected, the default Linux security
46 If you are unsure how to answer this question, answer N.
49 bool "Enable the securityfs filesystem"
51 This will build the securityfs filesystem. It is currently used by
52 the TPM bios character driver and IMA, an integrity provider. It is
53 not used by SELinux or SMACK.
55 If you are unsure how to answer this question, answer N.
57 config SECURITY_NETWORK
58 bool "Socket and Networking Security Hooks"
61 This enables the socket and networking security hooks.
62 If enabled, a security module can use these hooks to
63 implement socket and networking access controls.
64 If you are unsure how to answer this question, answer N.
66 config SECURITY_NETWORK_XFRM
67 bool "XFRM (IPSec) Networking Security Hooks"
68 depends on XFRM && SECURITY_NETWORK
70 This enables the XFRM (IPSec) networking security hooks.
71 If enabled, a security module can use these hooks to
72 implement per-packet access controls based on labels
73 derived from IPSec policy. Non-IPSec communications are
74 designated as unlabelled, and only sockets authorized
75 to communicate unlabelled data can send without using
77 If you are unsure how to answer this question, answer N.
80 bool "Security hooks for pathname based access control"
83 This enables the security hooks for pathname based access control.
84 If enabled, a security module can use these hooks to
85 implement pathname based access controls.
86 If you are unsure how to answer this question, answer N.
89 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
90 depends on HAVE_INTEL_TXT
92 This option enables support for booting the kernel with the
93 Trusted Boot (tboot) module. This will utilize
94 Intel(R) Trusted Execution Technology to perform a measured launch
95 of the kernel. If the system does not support Intel(R) TXT, this
98 Intel TXT will provide higher assurance of system configuration and
99 initial state as well as data reset protection. This is used to
100 create a robust initial kernel measurement and verification, which
101 helps to ensure that kernel security mechanisms are functioning
102 correctly. This level of protection requires a root of trust outside
103 of the kernel itself.
105 Intel TXT also helps solve real end user concerns about having
106 confidence that their hardware is running the VMM or kernel that
107 it was configured with, especially since they may be responsible for
108 providing such assurances to VMs and services running on it.
110 See <http://www.intel.com/technology/security/> for more information
112 See <http://tboot.sourceforge.net> for more information about tboot.
113 See Documentation/intel_txt.txt for a description of how to enable
114 Intel TXT support in a kernel boot.
116 If you are unsure as to whether this is required, answer N.
118 config LSM_MMAP_MIN_ADDR
119 int "Low address space for LSM to protect from user allocation"
120 depends on SECURITY && SECURITY_SELINUX
121 default 32768 if ARM || (ARM64 && COMPAT)
124 This is the portion of low virtual memory which should be protected
125 from userspace allocation. Keeping a user from writing to low pages
126 can help reduce the impact of kernel NULL pointer bugs.
128 For most ia64, ppc64 and x86 users with lots of address space
129 a value of 65536 is reasonable and should cause no problems.
130 On arm and other archs it should not be higher than 32768.
131 Programs which use vm86 functionality or have some need to map
132 this low address space will need the permission specific to the
135 config HAVE_HARDENED_USERCOPY_ALLOCATOR
138 The heap allocator implements __check_heap_object() for
139 validating memory ranges against heap object sizes in
140 support of CONFIG_HARDENED_USERCOPY.
142 config HAVE_ARCH_HARDENED_USERCOPY
145 The architecture supports CONFIG_HARDENED_USERCOPY by
146 calling check_object_size() just before performing the
147 userspace copies in the low level implementation of
148 copy_to_user() and copy_from_user().
150 config HARDENED_USERCOPY
151 bool "Harden memory copies between kernel and userspace"
152 depends on HAVE_ARCH_HARDENED_USERCOPY
153 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
156 This option checks for obviously wrong memory regions when
157 copying memory to/from the kernel (via copy_to_user() and
158 copy_from_user() functions) by rejecting memory ranges that
159 are larger than the specified heap object, span multiple
160 separately allocates pages, are not on the process stack,
161 or are part of the kernel text. This kills entire classes
162 of heap overflow exploits and similar kernel memory exposures.
164 config HARDENED_USERCOPY_PAGESPAN
165 bool "Refuse to copy allocations that span multiple pages"
166 depends on HARDENED_USERCOPY
167 depends on !COMPILE_TEST
169 When a multi-page allocation is done without __GFP_COMP,
170 hardened usercopy will reject attempts to copy it. There are,
171 however, several cases of this in the kernel that have not all
172 been removed. This config is intended to be used only while
173 trying to find such users.
175 source security/selinux/Kconfig
176 source security/smack/Kconfig
177 source security/tomoyo/Kconfig
178 source security/apparmor/Kconfig
179 source security/yama/Kconfig
181 source security/integrity/Kconfig
184 prompt "Default security module"
185 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
186 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
187 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
188 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
189 default DEFAULT_SECURITY_DAC
192 Select the security module that will be used by default if the
193 kernel parameter security= is not specified.
195 config DEFAULT_SECURITY_SELINUX
196 bool "SELinux" if SECURITY_SELINUX=y
198 config DEFAULT_SECURITY_SMACK
199 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
201 config DEFAULT_SECURITY_TOMOYO
202 bool "TOMOYO" if SECURITY_TOMOYO=y
204 config DEFAULT_SECURITY_APPARMOR
205 bool "AppArmor" if SECURITY_APPARMOR=y
207 config DEFAULT_SECURITY_DAC
208 bool "Unix Discretionary Access Controls"
212 config DEFAULT_SECURITY
214 default "selinux" if DEFAULT_SECURITY_SELINUX
215 default "smack" if DEFAULT_SECURITY_SMACK
216 default "tomoyo" if DEFAULT_SECURITY_TOMOYO
217 default "apparmor" if DEFAULT_SECURITY_APPARMOR
218 default "" if DEFAULT_SECURITY_DAC