blob: 923b120e0fa5cee6925ac8e2ac4b8b60b8561cec [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001config SECURITY_SMACK
2 bool "Simplified Mandatory Access Control Kernel Support"
Casey Schaufler111fe8b2012-11-02 11:28:11 -07003 depends on NET
4 depends on INET
5 depends on SECURITY
6 select NETLABEL
7 select SECURITY_NETWORK
Casey Schauflere114e472008-02-04 22:29:50 -08008 default n
9 help
10 This selects the Simplified Mandatory Access Control Kernel.
11 Smack is useful for sensitivity, integrity, and a variety
12 of other mandatory security schemes.
13 If you are unsure how to answer this question, answer N.
14
Casey Schauflerd166c802014-08-27 14:51:27 -070015config SECURITY_SMACK_BRINGUP
16 bool "Reporting on access granted by Smack rules"
17 depends on SECURITY_SMACK
18 default n
19 help
20 Enable the bring-up ("b") access mode in Smack rules.
21 When access is granted by a rule with the "b" mode a
22 message about the access requested is generated. The
23 intention is that a process can be granted a wide set
24 of access initially with the bringup mode set on the
25 rules. The developer can use the information to
26 identify which rules are necessary and what accesses
27 may be inappropriate. The developer can reduce the
28 access rule set once the behavior is well understood.
29 This is a superior mechanism to the oft abused
30 "permissive" mode of other systems.
Casey Schaufler69f287a2014-12-12 17:08:40 -080031 If you are unsure how to answer this question, answer N.
32
33config SECURITY_SMACK_NETFILTER
34 bool "Packet marking using secmarks for netfilter"
35 depends on SECURITY_SMACK
36 depends on NETWORK_SECMARK
37 depends on NETFILTER
38 default n
39 help
40 This enables security marking of network packets using
41 Smack labels.
42 If you are unsure how to answer this question, answer N.
Casey Schauflerc60b9062016-08-30 10:31:39 -070043
44config SECURITY_SMACK_APPEND_SIGNALS
45 bool "Treat delivering signals as an append operation"
46 depends on SECURITY_SMACK
47 default n
48 help
49 Sending a signal has been treated as a write operation to the
50 receiving process. If this option is selected, the delivery
51 will be an append operation instead. This makes it possible
52 to differentiate between delivering a network packet and
53 delivering a signal in the Smack rules.
54 If you are unsure how to answer this question, answer N.