blob: 638afc868ba257c4a75ba3e6bbf9fb9a8e4cb14a [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#
2# Security configuration
3#
4
5menu "Security options"
6
David Howellsf0894942012-05-11 10:56:56 +01007source security/keys/Kconfig
Linus Torvalds1da177e2005-04-16 15:20:36 -07008
Neeraj Soni7b939262017-11-15 16:31:27 +05309if ARCH_QCOM
10source security/pfe/Kconfig
11endif
12
13
Dan Rosenbergeaf06b22010-11-11 14:05:18 -080014config SECURITY_DMESG_RESTRICT
15 bool "Restrict unprivileged access to the kernel syslog"
16 default n
17 help
18 This enforces restrictions on unprivileged users reading the kernel
19 syslog via dmesg(8).
20
21 If this option is not selected, no restrictions will be enforced
22 unless the dmesg_restrict sysctl is explicitly set to (1).
23
24 If you are unsure how to answer this question, answer N.
25
Jeff Vander Stoep4375d062016-05-29 14:22:32 -070026config SECURITY_PERF_EVENTS_RESTRICT
27 bool "Restrict unprivileged use of performance events"
28 depends on PERF_EVENTS
29 help
30 If you say Y here, the kernel.perf_event_paranoid sysctl
31 will be set to 3 by default, and no unprivileged use of the
32 perf_event_open syscall will be permitted unless it is
33 changed.
34
Linus Torvalds1da177e2005-04-16 15:20:36 -070035config SECURITY
36 bool "Enable different security models"
Adrian Bunk2c405792005-08-22 18:20:50 +020037 depends on SYSFS
Iulia Manda28138932015-04-15 16:16:41 -070038 depends on MULTIUSER
Linus Torvalds1da177e2005-04-16 15:20:36 -070039 help
40 This allows you to choose different security modules to be
41 configured into your kernel.
42
43 If this option is not selected, the default Linux security
44 model will be used.
45
46 If you are unsure how to answer this question, answer N.
47
James Morris45351052017-02-15 00:17:24 +110048config SECURITY_WRITABLE_HOOKS
49 depends on SECURITY
50 bool
51 default n
52
Kees Cooke71fac02018-01-03 10:17:35 -080053config PAGE_TABLE_ISOLATION
Richard Fellner13be4482017-05-04 14:26:50 +020054 bool "Remove the kernel mapping in user mode"
Dave Hansen8f0baad2017-08-30 16:23:00 -070055 default y
Borislav Petkov2c272172018-01-02 14:19:49 +010056 depends on X86_64 && SMP
Richard Fellner13be4482017-05-04 14:26:50 +020057 help
Hugh Dickins639c0052017-09-13 14:03:10 -070058 This enforces a strict kernel and user space isolation, in order
59 to close hardware side channels on kernel address information.
60
61 If you are unsure how to answer this question, answer Y.
Linus Torvalds1da177e2005-04-16 15:20:36 -070062
Eric Parisda318942008-08-22 11:35:57 -040063config SECURITYFS
64 bool "Enable the securityfs filesystem"
65 help
66 This will build the securityfs filesystem. It is currently used by
Mimi Zohar3323eec92009-02-04 09:06:58 -050067 the TPM bios character driver and IMA, an integrity provider. It is
68 not used by SELinux or SMACK.
Eric Parisda318942008-08-22 11:35:57 -040069
70 If you are unsure how to answer this question, answer N.
71
Linus Torvalds1da177e2005-04-16 15:20:36 -070072config SECURITY_NETWORK
73 bool "Socket and Networking Security Hooks"
74 depends on SECURITY
75 help
76 This enables the socket and networking security hooks.
77 If enabled, a security module can use these hooks to
78 implement socket and networking access controls.
79 If you are unsure how to answer this question, answer N.
80
Trent Jaegerdf718372005-12-13 23:12:27 -080081config SECURITY_NETWORK_XFRM
82 bool "XFRM (IPSec) Networking Security Hooks"
83 depends on XFRM && SECURITY_NETWORK
84 help
85 This enables the XFRM (IPSec) networking security hooks.
86 If enabled, a security module can use these hooks to
87 implement per-packet access controls based on labels
88 derived from IPSec policy. Non-IPSec communications are
89 designated as unlabelled, and only sockets authorized
90 to communicate unlabelled data can send without using
91 IPSec.
92 If you are unsure how to answer this question, answer N.
93
Kentaro Takedabe6d3e52008-12-17 13:24:15 +090094config SECURITY_PATH
95 bool "Security hooks for pathname based access control"
96 depends on SECURITY
97 help
98 This enables the security hooks for pathname based access control.
99 If enabled, a security module can use these hooks to
100 implement pathname based access controls.
101 If you are unsure how to answer this question, answer N.
102
Joseph Cihula31625342009-06-30 19:30:59 -0700103config INTEL_TXT
104 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
Shane Wang69575d32009-09-01 18:25:07 -0700105 depends on HAVE_INTEL_TXT
Joseph Cihula31625342009-06-30 19:30:59 -0700106 help
107 This option enables support for booting the kernel with the
108 Trusted Boot (tboot) module. This will utilize
109 Intel(R) Trusted Execution Technology to perform a measured launch
110 of the kernel. If the system does not support Intel(R) TXT, this
111 will have no effect.
112
Arnaldo Carvalho de Melo3c556e42009-08-12 12:00:40 -0300113 Intel TXT will provide higher assurance of system configuration and
Joseph Cihula31625342009-06-30 19:30:59 -0700114 initial state as well as data reset protection. This is used to
115 create a robust initial kernel measurement and verification, which
116 helps to ensure that kernel security mechanisms are functioning
117 correctly. This level of protection requires a root of trust outside
118 of the kernel itself.
119
120 Intel TXT also helps solve real end user concerns about having
121 confidence that their hardware is running the VMM or kernel that
Arnaldo Carvalho de Melo3c556e42009-08-12 12:00:40 -0300122 it was configured with, especially since they may be responsible for
Joseph Cihula31625342009-06-30 19:30:59 -0700123 providing such assurances to VMs and services running on it.
124
125 See <http://www.intel.com/technology/security/> for more information
126 about Intel(R) TXT.
127 See <http://tboot.sourceforge.net> for more information about tboot.
128 See Documentation/intel_txt.txt for a description of how to enable
129 Intel TXT support in a kernel boot.
130
131 If you are unsure as to whether this is required, answer N.
132
Eric Paris788084a2009-07-31 12:54:11 -0400133config LSM_MMAP_MIN_ADDR
Andreas Schwab024e6cb2009-08-18 22:14:29 +0200134 int "Low address space for LSM to protect from user allocation"
Eric Paris788084a2009-07-31 12:54:11 -0400135 depends on SECURITY && SECURITY_SELINUX
Colin Cross530b0992014-02-04 02:15:32 +0000136 default 32768 if ARM || (ARM64 && COMPAT)
Dave Jonesa58578e2009-08-18 13:47:37 -0400137 default 65536
Eric Paris788084a2009-07-31 12:54:11 -0400138 help
139 This is the portion of low virtual memory which should be protected
140 from userspace allocation. Keeping a user from writing to low pages
141 can help reduce the impact of kernel NULL pointer bugs.
142
143 For most ia64, ppc64 and x86 users with lots of address space
144 a value of 65536 is reasonable and should cause no problems.
145 On arm and other archs it should not be higher than 32768.
146 Programs which use vm86 functionality or have some need to map
147 this low address space will need the permission specific to the
148 systems running LSM.
149
Kees Cookf5509cc2016-06-07 11:05:33 -0700150config HAVE_HARDENED_USERCOPY_ALLOCATOR
151 bool
152 help
153 The heap allocator implements __check_heap_object() for
154 validating memory ranges against heap object sizes in
155 support of CONFIG_HARDENED_USERCOPY.
156
157config HAVE_ARCH_HARDENED_USERCOPY
158 bool
159 help
160 The architecture supports CONFIG_HARDENED_USERCOPY by
161 calling check_object_size() just before performing the
162 userspace copies in the low level implementation of
163 copy_to_user() and copy_from_user().
164
165config HARDENED_USERCOPY
166 bool "Harden memory copies between kernel and userspace"
167 depends on HAVE_ARCH_HARDENED_USERCOPY
Linus Torvalds6040e572016-08-19 12:47:01 -0700168 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
Kees Cookf5509cc2016-06-07 11:05:33 -0700169 select BUG
170 help
171 This option checks for obviously wrong memory regions when
172 copying memory to/from the kernel (via copy_to_user() and
173 copy_from_user() functions) by rejecting memory ranges that
174 are larger than the specified heap object, span multiple
175 separately allocates pages, are not on the process stack,
176 or are part of the kernel text. This kills entire classes
177 of heap overflow exploits and similar kernel memory exposures.
178
Kees Cook8e1f74e2016-09-07 09:54:34 -0700179config HARDENED_USERCOPY_PAGESPAN
180 bool "Refuse to copy allocations that span multiple pages"
181 depends on HARDENED_USERCOPY
Linus Torvalds80a77042016-09-07 14:03:49 -0700182 depends on EXPERT
Kees Cook8e1f74e2016-09-07 09:54:34 -0700183 help
184 When a multi-page allocation is done without __GFP_COMP,
185 hardened usercopy will reject attempts to copy it. There are,
186 however, several cases of this in the kernel that have not all
187 been removed. This config is intended to be used only while
188 trying to find such users.
189
Daniel Micay0f513102017-07-12 14:36:10 -0700190config FORTIFY_SOURCE
191 bool "Harden common str/mem functions against buffer overflows"
192 depends on ARCH_HAS_FORTIFY_SOURCE
193 help
194 Detect overflows of buffers in common string and memory functions
195 where the compiler can determine and validate the buffer sizes.
196
Linus Torvalds1da177e2005-04-16 15:20:36 -0700197source security/selinux/Kconfig
Casey Schauflere114e472008-02-04 22:29:50 -0800198source security/smack/Kconfig
Kentaro Takeda00d7d6f2009-02-05 17:18:17 +0900199source security/tomoyo/Kconfig
John Johansenf9ad1af2010-07-29 14:48:08 -0700200source security/apparmor/Kconfig
Kees Cook9b091552016-04-20 15:46:28 -0700201source security/loadpin/Kconfig
Kees Cook2d514482011-12-21 12:17:04 -0800202source security/yama/Kconfig
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203
Mimi Zoharf381c272011-03-09 14:13:22 -0500204source security/integrity/Kconfig
Mimi Zohar3323eec92009-02-04 09:06:58 -0500205
John Johansen6e65f922009-11-05 17:03:20 -0800206choice
207 prompt "Default security module"
208 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
209 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
210 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
John Johansenf9ad1af2010-07-29 14:48:08 -0700211 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
John Johansen6e65f922009-11-05 17:03:20 -0800212 default DEFAULT_SECURITY_DAC
213
214 help
215 Select the security module that will be used by default if the
216 kernel parameter security= is not specified.
217
218 config DEFAULT_SECURITY_SELINUX
219 bool "SELinux" if SECURITY_SELINUX=y
220
221 config DEFAULT_SECURITY_SMACK
222 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
223
224 config DEFAULT_SECURITY_TOMOYO
225 bool "TOMOYO" if SECURITY_TOMOYO=y
226
John Johansenf9ad1af2010-07-29 14:48:08 -0700227 config DEFAULT_SECURITY_APPARMOR
228 bool "AppArmor" if SECURITY_APPARMOR=y
229
John Johansen6e65f922009-11-05 17:03:20 -0800230 config DEFAULT_SECURITY_DAC
231 bool "Unix Discretionary Access Controls"
232
233endchoice
234
235config DEFAULT_SECURITY
236 string
237 default "selinux" if DEFAULT_SECURITY_SELINUX
238 default "smack" if DEFAULT_SECURITY_SMACK
239 default "tomoyo" if DEFAULT_SECURITY_TOMOYO
John Johansenf9ad1af2010-07-29 14:48:08 -0700240 default "apparmor" if DEFAULT_SECURITY_APPARMOR
John Johansen6e65f922009-11-05 17:03:20 -0800241 default "" if DEFAULT_SECURITY_DAC
242
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243endmenu
244