Kconfig 3.9 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
#
# Security configuration
#

menu "Security options"

config KEYS
	bool "Enable access key retention support"
	help
	  This option provides support for retaining authentication tokens and
	  access keys in the kernel.

	  It also includes provision of methods by which such keys might be
	  associated with a process so that network filesystems, encryption
	  support and the like can find them.

	  Furthermore, a special type of key is available that acts as keyring:
	  a searchable sequence of keys. Each process is equipped with access
	  to five standard keyrings: UID-specific, GID-specific, session,
	  process and thread.

	  If you are unsure as to whether this is required, answer N.

config KEYS_DEBUG_PROC_KEYS
25
	bool "Enable the /proc/keys file by which keys may be viewed"
L
Linus Torvalds 已提交
26 27
	depends on KEYS
	help
28 29 30
	  This option turns on support for the /proc/keys file - through which
	  can be listed all the keys on the system that are viewable by the
	  reading process.
L
Linus Torvalds 已提交
31

32 33 34 35 36 37 38 39 40
	  The only keys included in the list are those that grant View
	  permission to the reading process whether or not it possesses them.
	  Note that LSM security checks are still performed, and may further
	  filter out keys that the current process is not authorised to view.

	  Only key attributes are listed here; key payloads are not included in
	  the resulting table.

	  If you are unsure as to whether this is required, answer N.
L
Linus Torvalds 已提交
41 42 43

config SECURITY
	bool "Enable different security models"
44
	depends on SYSFS
L
Linus Torvalds 已提交
45 46 47 48 49 50 51 52 53
	help
	  This allows you to choose different security modules to be
	  configured into your kernel.

	  If this option is not selected, the default Linux security
	  model will be used.

	  If you are unsure how to answer this question, answer N.

54 55 56 57
config SECURITYFS
	bool "Enable the securityfs filesystem"
	help
	  This will build the securityfs filesystem.  It is currently used by
58 59
	  the TPM bios character driver and IMA, an integrity provider.  It is
	  not used by SELinux or SMACK.
60 61 62

	  If you are unsure how to answer this question, answer N.

L
Linus Torvalds 已提交
63 64 65 66 67 68 69 70
config SECURITY_NETWORK
	bool "Socket and Networking Security Hooks"
	depends on SECURITY
	help
	  This enables the socket and networking security hooks.
	  If enabled, a security module can use these hooks to
	  implement socket and networking access controls.
	  If you are unsure how to answer this question, answer N.
71 72 73 74 75 76 77 78 79 80 81 82 83

config SECURITY_NETWORK_XFRM
	bool "XFRM (IPSec) Networking Security Hooks"
	depends on XFRM && SECURITY_NETWORK
	help
	  This enables the XFRM (IPSec) networking security hooks.
	  If enabled, a security module can use these hooks to
	  implement per-packet access controls based on labels
	  derived from IPSec policy.  Non-IPSec communications are
	  designated as unlabelled, and only sockets authorized
	  to communicate unlabelled data can send without using
	  IPSec.
	  If you are unsure how to answer this question, answer N.
L
Linus Torvalds 已提交
84

85 86 87 88 89 90 91 92 93
config SECURITY_PATH
	bool "Security hooks for pathname based access control"
	depends on SECURITY
	help
	  This enables the security hooks for pathname based access control.
	  If enabled, a security module can use these hooks to
	  implement pathname based access controls.
	  If you are unsure how to answer this question, answer N.

94
config SECURITY_FILE_CAPABILITIES
95
	bool "File POSIX Capabilities"
96 97 98 99 100 101 102
	default n
	help
	  This enables filesystem capabilities, allowing you to give
	  binaries a subset of root's powers without using setuid 0.

	  If in doubt, answer N.

L
Linus Torvalds 已提交
103
config SECURITY_ROOTPLUG
104 105
	bool "Root Plug Support"
	depends on USB=y && SECURITY
L
Linus Torvalds 已提交
106 107 108 109 110 111 112
	help
	  This is a sample LSM module that should only be used as such.
	  It prevents any programs running with egid == 0 if a specific
	  USB device is not present in the system.

	  See <http://www.linuxjournal.com/article.php?sid=6279> for
	  more information about this module.
113

114
	  If you are unsure how to answer this question, answer N.
115

L
Linus Torvalds 已提交
116
source security/selinux/Kconfig
117
source security/smack/Kconfig
K
Kentaro Takeda 已提交
118
source security/tomoyo/Kconfig
L
Linus Torvalds 已提交
119

120 121
source security/integrity/ima/Kconfig

L
Linus Torvalds 已提交
122 123
endmenu