| Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 1 | config SECURITY_SMACK |
| 2 | bool "Simplified Mandatory Access Control Kernel Support" |
| Casey Schaufler | 111fe8b | 2012-11-02 11:28:11 -0700 | [diff] [blame] | 3 | depends on NET |
| 4 | depends on INET |
| 5 | depends on SECURITY |
| 6 | select NETLABEL |
| 7 | select SECURITY_NETWORK |
| Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 8 | default n |
| 9 | help |
| 10 | This selects the Simplified Mandatory Access Control Kernel. |
| 11 | Smack is useful for sensitivity, integrity, and a variety |
| 12 | of other mandatory security schemes. |
| 13 | If you are unsure how to answer this question, answer N. |
| 14 | |
| Casey Schaufler | d166c80 | 2014-08-27 14:51:27 -0700 | [diff] [blame] | 15 | config SECURITY_SMACK_BRINGUP |
| 16 | bool "Reporting on access granted by Smack rules" |
| 17 | depends on SECURITY_SMACK |
| 18 | default n |
| 19 | help |
| 20 | Enable the bring-up ("b") access mode in Smack rules. |
| 21 | When access is granted by a rule with the "b" mode a |
| 22 | message about the access requested is generated. The |
| 23 | intention is that a process can be granted a wide set |
| 24 | of access initially with the bringup mode set on the |
| 25 | rules. The developer can use the information to |
| 26 | identify which rules are necessary and what accesses |
| 27 | may be inappropriate. The developer can reduce the |
| 28 | access rule set once the behavior is well understood. |
| 29 | This is a superior mechanism to the oft abused |
| 30 | "permissive" mode of other systems. |
| Casey Schaufler | 69f287a | 2014-12-12 17:08:40 -0800 | [diff] [blame] | 31 | If you are unsure how to answer this question, answer N. |
| 32 | |
| 33 | config SECURITY_SMACK_NETFILTER |
| 34 | bool "Packet marking using secmarks for netfilter" |
| 35 | depends on SECURITY_SMACK |
| 36 | depends on NETWORK_SECMARK |
| 37 | depends on NETFILTER |
| 38 | default n |
| 39 | help |
| 40 | This enables security marking of network packets using |
| 41 | Smack labels. |
| 42 | If you are unsure how to answer this question, answer N. |
| Casey Schaufler | c60b906 | 2016-08-30 10:31:39 -0700 | [diff] [blame] | 43 | |
| 44 | config SECURITY_SMACK_APPEND_SIGNALS |
| 45 | bool "Treat delivering signals as an append operation" |
| 46 | depends on SECURITY_SMACK |
| 47 | default n |
| 48 | help |
| 49 | Sending a signal has been treated as a write operation to the |
| 50 | receiving process. If this option is selected, the delivery |
| 51 | will be an append operation instead. This makes it possible |
| 52 | to differentiate between delivering a network packet and |
| 53 | delivering a signal in the Smack rules. |
| 54 | If you are unsure how to answer this question, answer N. |