2 # Security configuration
5 menu "Security options"
7 source security/keys/Kconfig
9 config SECURITY_DMESG_RESTRICT
10 bool "Restrict unprivileged access to the kernel syslog"
13 This enforces restrictions on unprivileged users reading the kernel
16 If this option is not selected, no restrictions will be enforced
17 unless the dmesg_restrict sysctl is explicitly set to (1).
19 If you are unsure how to answer this question, answer N.
21 config SECURITY_PERF_EVENTS_RESTRICT
22 bool "Restrict unprivileged use of performance events"
23 depends on PERF_EVENTS
25 If you say Y here, the kernel.perf_event_paranoid sysctl
26 will be set to 3 by default, and no unprivileged use of the
27 perf_event_open syscall will be permitted unless it is
31 bool "Enable different security models"
35 This allows you to choose different security modules to be
36 configured into your kernel.
38 If this option is not selected, the default Linux security
41 If you are unsure how to answer this question, answer N.
43 config PAGE_TABLE_ISOLATION
44 bool "Remove the kernel mapping in user mode"
46 depends on X86_64 && SMP
48 This enforces a strict kernel and user space isolation, in order
49 to close hardware side channels on kernel address information.
51 If you are unsure how to answer this question, answer Y.
54 bool "Enable the securityfs filesystem"
56 This will build the securityfs filesystem. It is currently used by
57 the TPM bios character driver and IMA, an integrity provider. It is
58 not used by SELinux or SMACK.
60 If you are unsure how to answer this question, answer N.
62 config SECURITY_NETWORK
63 bool "Socket and Networking Security Hooks"
66 This enables the socket and networking security hooks.
67 If enabled, a security module can use these hooks to
68 implement socket and networking access controls.
69 If you are unsure how to answer this question, answer N.
71 config SECURITY_NETWORK_XFRM
72 bool "XFRM (IPSec) Networking Security Hooks"
73 depends on XFRM && SECURITY_NETWORK
75 This enables the XFRM (IPSec) networking security hooks.
76 If enabled, a security module can use these hooks to
77 implement per-packet access controls based on labels
78 derived from IPSec policy. Non-IPSec communications are
79 designated as unlabelled, and only sockets authorized
80 to communicate unlabelled data can send without using
82 If you are unsure how to answer this question, answer N.
85 bool "Security hooks for pathname based access control"
88 This enables the security hooks for pathname based access control.
89 If enabled, a security module can use these hooks to
90 implement pathname based access controls.
91 If you are unsure how to answer this question, answer N.
94 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
95 depends on HAVE_INTEL_TXT
97 This option enables support for booting the kernel with the
98 Trusted Boot (tboot) module. This will utilize
99 Intel(R) Trusted Execution Technology to perform a measured launch
100 of the kernel. If the system does not support Intel(R) TXT, this
103 Intel TXT will provide higher assurance of system configuration and
104 initial state as well as data reset protection. This is used to
105 create a robust initial kernel measurement and verification, which
106 helps to ensure that kernel security mechanisms are functioning
107 correctly. This level of protection requires a root of trust outside
108 of the kernel itself.
110 Intel TXT also helps solve real end user concerns about having
111 confidence that their hardware is running the VMM or kernel that
112 it was configured with, especially since they may be responsible for
113 providing such assurances to VMs and services running on it.
115 See <http://www.intel.com/technology/security/> for more information
117 See <http://tboot.sourceforge.net> for more information about tboot.
118 See Documentation/intel_txt.txt for a description of how to enable
119 Intel TXT support in a kernel boot.
121 If you are unsure as to whether this is required, answer N.
123 config LSM_MMAP_MIN_ADDR
124 int "Low address space for LSM to protect from user allocation"
125 depends on SECURITY && SECURITY_SELINUX
126 default 32768 if ARM || (ARM64 && COMPAT)
129 This is the portion of low virtual memory which should be protected
130 from userspace allocation. Keeping a user from writing to low pages
131 can help reduce the impact of kernel NULL pointer bugs.
133 For most ia64, ppc64 and x86 users with lots of address space
134 a value of 65536 is reasonable and should cause no problems.
135 On arm and other archs it should not be higher than 32768.
136 Programs which use vm86 functionality or have some need to map
137 this low address space will need the permission specific to the
140 config HAVE_HARDENED_USERCOPY_ALLOCATOR
143 The heap allocator implements __check_heap_object() for
144 validating memory ranges against heap object sizes in
145 support of CONFIG_HARDENED_USERCOPY.
147 config HAVE_ARCH_HARDENED_USERCOPY
150 The architecture supports CONFIG_HARDENED_USERCOPY by
151 calling check_object_size() just before performing the
152 userspace copies in the low level implementation of
153 copy_to_user() and copy_from_user().
155 config HARDENED_USERCOPY
156 bool "Harden memory copies between kernel and userspace"
157 depends on HAVE_ARCH_HARDENED_USERCOPY
158 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
161 This option checks for obviously wrong memory regions when
162 copying memory to/from the kernel (via copy_to_user() and
163 copy_from_user() functions) by rejecting memory ranges that
164 are larger than the specified heap object, span multiple
165 separately allocates pages, are not on the process stack,
166 or are part of the kernel text. This kills entire classes
167 of heap overflow exploits and similar kernel memory exposures.
169 config HARDENED_USERCOPY_PAGESPAN
170 bool "Refuse to copy allocations that span multiple pages"
171 depends on HARDENED_USERCOPY
172 depends on !COMPILE_TEST
174 When a multi-page allocation is done without __GFP_COMP,
175 hardened usercopy will reject attempts to copy it. There are,
176 however, several cases of this in the kernel that have not all
177 been removed. This config is intended to be used only while
178 trying to find such users.
180 source security/selinux/Kconfig
181 source security/smack/Kconfig
182 source security/tomoyo/Kconfig
183 source security/apparmor/Kconfig
184 source security/yama/Kconfig
186 source security/integrity/Kconfig
189 prompt "Default security module"
190 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
191 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
192 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
193 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
194 default DEFAULT_SECURITY_DAC
197 Select the security module that will be used by default if the
198 kernel parameter security= is not specified.
200 config DEFAULT_SECURITY_SELINUX
201 bool "SELinux" if SECURITY_SELINUX=y
203 config DEFAULT_SECURITY_SMACK
204 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
206 config DEFAULT_SECURITY_TOMOYO
207 bool "TOMOYO" if SECURITY_TOMOYO=y
209 config DEFAULT_SECURITY_APPARMOR
210 bool "AppArmor" if SECURITY_APPARMOR=y
212 config DEFAULT_SECURITY_DAC
213 bool "Unix Discretionary Access Controls"
217 config DEFAULT_SECURITY
219 default "selinux" if DEFAULT_SECURITY_SELINUX
220 default "smack" if DEFAULT_SECURITY_SMACK
221 default "tomoyo" if DEFAULT_SECURITY_TOMOYO
222 default "apparmor" if DEFAULT_SECURITY_APPARMOR
223 default "" if DEFAULT_SECURITY_DAC