Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # Security configuration |
| 3 | # |
| 4 | |
| 5 | menu "Security options" |
| 6 | |
David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 7 | source security/keys/Kconfig |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 8 | |
Dan Rosenberg | eaf06b2 | 2010-11-11 14:05:18 -0800 | [diff] [blame] | 9 | config SECURITY_DMESG_RESTRICT |
| 10 | bool "Restrict unprivileged access to the kernel syslog" |
| 11 | default n |
| 12 | help |
| 13 | This enforces restrictions on unprivileged users reading the kernel |
| 14 | syslog via dmesg(8). |
| 15 | |
| 16 | If this option is not selected, no restrictions will be enforced |
| 17 | unless the dmesg_restrict sysctl is explicitly set to (1). |
| 18 | |
| 19 | If you are unsure how to answer this question, answer N. |
| 20 | |
Jeff Vander Stoep | 4375d06 | 2016-05-29 14:22:32 -0700 | [diff] [blame] | 21 | config SECURITY_PERF_EVENTS_RESTRICT |
| 22 | bool "Restrict unprivileged use of performance events" |
| 23 | depends on PERF_EVENTS |
| 24 | help |
| 25 | If you say Y here, the kernel.perf_event_paranoid sysctl |
| 26 | will be set to 3 by default, and no unprivileged use of the |
| 27 | perf_event_open syscall will be permitted unless it is |
| 28 | changed. |
| 29 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | config SECURITY |
| 31 | bool "Enable different security models" |
Adrian Bunk | 2c40579 | 2005-08-22 18:20:50 +0200 | [diff] [blame] | 32 | depends on SYSFS |
Iulia Manda | 2813893 | 2015-04-15 16:16:41 -0700 | [diff] [blame] | 33 | depends on MULTIUSER |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | help |
| 35 | This allows you to choose different security modules to be |
| 36 | configured into your kernel. |
| 37 | |
| 38 | If this option is not selected, the default Linux security |
| 39 | model will be used. |
| 40 | |
| 41 | If you are unsure how to answer this question, answer N. |
| 42 | |
James Morris | 4535105 | 2017-02-15 00:17:24 +1100 | [diff] [blame] | 43 | config SECURITY_WRITABLE_HOOKS |
| 44 | depends on SECURITY |
| 45 | bool |
| 46 | default n |
| 47 | |
Kees Cook | e71fac0 | 2018-01-03 10:17:35 -0800 | [diff] [blame] | 48 | config PAGE_TABLE_ISOLATION |
Richard Fellner | 13be448 | 2017-05-04 14:26:50 +0200 | [diff] [blame] | 49 | bool "Remove the kernel mapping in user mode" |
Dave Hansen | 8f0baad | 2017-08-30 16:23:00 -0700 | [diff] [blame] | 50 | default y |
Borislav Petkov | 2c27217 | 2018-01-02 14:19:49 +0100 | [diff] [blame] | 51 | depends on X86_64 && SMP |
Richard Fellner | 13be448 | 2017-05-04 14:26:50 +0200 | [diff] [blame] | 52 | help |
Hugh Dickins | 639c005 | 2017-09-13 14:03:10 -0700 | [diff] [blame] | 53 | This enforces a strict kernel and user space isolation, in order |
| 54 | to close hardware side channels on kernel address information. |
| 55 | |
| 56 | If you are unsure how to answer this question, answer Y. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 57 | |
Eric Paris | da31894 | 2008-08-22 11:35:57 -0400 | [diff] [blame] | 58 | config SECURITYFS |
| 59 | bool "Enable the securityfs filesystem" |
| 60 | help |
| 61 | This will build the securityfs filesystem. It is currently used by |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 62 | the TPM bios character driver and IMA, an integrity provider. It is |
| 63 | not used by SELinux or SMACK. |
Eric Paris | da31894 | 2008-08-22 11:35:57 -0400 | [diff] [blame] | 64 | |
| 65 | If you are unsure how to answer this question, answer N. |
| 66 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | config SECURITY_NETWORK |
| 68 | bool "Socket and Networking Security Hooks" |
| 69 | depends on SECURITY |
| 70 | help |
| 71 | This enables the socket and networking security hooks. |
| 72 | If enabled, a security module can use these hooks to |
| 73 | implement socket and networking access controls. |
| 74 | If you are unsure how to answer this question, answer N. |
| 75 | |
Trent Jaeger | df71837 | 2005-12-13 23:12:27 -0800 | [diff] [blame] | 76 | config SECURITY_NETWORK_XFRM |
| 77 | bool "XFRM (IPSec) Networking Security Hooks" |
| 78 | depends on XFRM && SECURITY_NETWORK |
| 79 | help |
| 80 | This enables the XFRM (IPSec) networking security hooks. |
| 81 | If enabled, a security module can use these hooks to |
| 82 | implement per-packet access controls based on labels |
| 83 | derived from IPSec policy. Non-IPSec communications are |
| 84 | designated as unlabelled, and only sockets authorized |
| 85 | to communicate unlabelled data can send without using |
| 86 | IPSec. |
| 87 | If you are unsure how to answer this question, answer N. |
| 88 | |
Kentaro Takeda | be6d3e5 | 2008-12-17 13:24:15 +0900 | [diff] [blame] | 89 | config SECURITY_PATH |
| 90 | bool "Security hooks for pathname based access control" |
| 91 | depends on SECURITY |
| 92 | help |
| 93 | This enables the security hooks for pathname based access control. |
| 94 | If enabled, a security module can use these hooks to |
| 95 | implement pathname based access controls. |
| 96 | If you are unsure how to answer this question, answer N. |
| 97 | |
Joseph Cihula | 3162534 | 2009-06-30 19:30:59 -0700 | [diff] [blame] | 98 | config INTEL_TXT |
| 99 | bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)" |
Shane Wang | 69575d3 | 2009-09-01 18:25:07 -0700 | [diff] [blame] | 100 | depends on HAVE_INTEL_TXT |
Joseph Cihula | 3162534 | 2009-06-30 19:30:59 -0700 | [diff] [blame] | 101 | help |
| 102 | This option enables support for booting the kernel with the |
| 103 | Trusted Boot (tboot) module. This will utilize |
| 104 | Intel(R) Trusted Execution Technology to perform a measured launch |
| 105 | of the kernel. If the system does not support Intel(R) TXT, this |
| 106 | will have no effect. |
| 107 | |
Arnaldo Carvalho de Melo | 3c556e4 | 2009-08-12 12:00:40 -0300 | [diff] [blame] | 108 | Intel TXT will provide higher assurance of system configuration and |
Joseph Cihula | 3162534 | 2009-06-30 19:30:59 -0700 | [diff] [blame] | 109 | initial state as well as data reset protection. This is used to |
| 110 | create a robust initial kernel measurement and verification, which |
| 111 | helps to ensure that kernel security mechanisms are functioning |
| 112 | correctly. This level of protection requires a root of trust outside |
| 113 | of the kernel itself. |
| 114 | |
| 115 | Intel TXT also helps solve real end user concerns about having |
| 116 | confidence that their hardware is running the VMM or kernel that |
Arnaldo Carvalho de Melo | 3c556e4 | 2009-08-12 12:00:40 -0300 | [diff] [blame] | 117 | it was configured with, especially since they may be responsible for |
Joseph Cihula | 3162534 | 2009-06-30 19:30:59 -0700 | [diff] [blame] | 118 | providing such assurances to VMs and services running on it. |
| 119 | |
| 120 | See <http://www.intel.com/technology/security/> for more information |
| 121 | about Intel(R) TXT. |
| 122 | See <http://tboot.sourceforge.net> for more information about tboot. |
| 123 | See Documentation/intel_txt.txt for a description of how to enable |
| 124 | Intel TXT support in a kernel boot. |
| 125 | |
| 126 | If you are unsure as to whether this is required, answer N. |
| 127 | |
Eric Paris | 788084a | 2009-07-31 12:54:11 -0400 | [diff] [blame] | 128 | config LSM_MMAP_MIN_ADDR |
Andreas Schwab | 024e6cb | 2009-08-18 22:14:29 +0200 | [diff] [blame] | 129 | int "Low address space for LSM to protect from user allocation" |
Eric Paris | 788084a | 2009-07-31 12:54:11 -0400 | [diff] [blame] | 130 | depends on SECURITY && SECURITY_SELINUX |
Colin Cross | 530b099 | 2014-02-04 02:15:32 +0000 | [diff] [blame] | 131 | default 32768 if ARM || (ARM64 && COMPAT) |
Dave Jones | a58578e | 2009-08-18 13:47:37 -0400 | [diff] [blame] | 132 | default 65536 |
Eric Paris | 788084a | 2009-07-31 12:54:11 -0400 | [diff] [blame] | 133 | help |
| 134 | This is the portion of low virtual memory which should be protected |
| 135 | from userspace allocation. Keeping a user from writing to low pages |
| 136 | can help reduce the impact of kernel NULL pointer bugs. |
| 137 | |
| 138 | For most ia64, ppc64 and x86 users with lots of address space |
| 139 | a value of 65536 is reasonable and should cause no problems. |
| 140 | On arm and other archs it should not be higher than 32768. |
| 141 | Programs which use vm86 functionality or have some need to map |
| 142 | this low address space will need the permission specific to the |
| 143 | systems running LSM. |
| 144 | |
Kees Cook | f5509cc | 2016-06-07 11:05:33 -0700 | [diff] [blame] | 145 | config HAVE_HARDENED_USERCOPY_ALLOCATOR |
| 146 | bool |
| 147 | help |
| 148 | The heap allocator implements __check_heap_object() for |
| 149 | validating memory ranges against heap object sizes in |
| 150 | support of CONFIG_HARDENED_USERCOPY. |
| 151 | |
| 152 | config HAVE_ARCH_HARDENED_USERCOPY |
| 153 | bool |
| 154 | help |
| 155 | The architecture supports CONFIG_HARDENED_USERCOPY by |
| 156 | calling check_object_size() just before performing the |
| 157 | userspace copies in the low level implementation of |
| 158 | copy_to_user() and copy_from_user(). |
| 159 | |
| 160 | config HARDENED_USERCOPY |
| 161 | bool "Harden memory copies between kernel and userspace" |
| 162 | depends on HAVE_ARCH_HARDENED_USERCOPY |
Linus Torvalds | 6040e57 | 2016-08-19 12:47:01 -0700 | [diff] [blame] | 163 | depends on HAVE_HARDENED_USERCOPY_ALLOCATOR |
Kees Cook | f5509cc | 2016-06-07 11:05:33 -0700 | [diff] [blame] | 164 | select BUG |
| 165 | help |
| 166 | This option checks for obviously wrong memory regions when |
| 167 | copying memory to/from the kernel (via copy_to_user() and |
| 168 | copy_from_user() functions) by rejecting memory ranges that |
| 169 | are larger than the specified heap object, span multiple |
| 170 | separately allocates pages, are not on the process stack, |
| 171 | or are part of the kernel text. This kills entire classes |
| 172 | of heap overflow exploits and similar kernel memory exposures. |
| 173 | |
Kees Cook | 8e1f74e | 2016-09-07 09:54:34 -0700 | [diff] [blame] | 174 | config HARDENED_USERCOPY_PAGESPAN |
| 175 | bool "Refuse to copy allocations that span multiple pages" |
| 176 | depends on HARDENED_USERCOPY |
Linus Torvalds | 80a7704 | 2016-09-07 14:03:49 -0700 | [diff] [blame] | 177 | depends on EXPERT |
Kees Cook | 8e1f74e | 2016-09-07 09:54:34 -0700 | [diff] [blame] | 178 | help |
| 179 | When a multi-page allocation is done without __GFP_COMP, |
| 180 | hardened usercopy will reject attempts to copy it. There are, |
| 181 | however, several cases of this in the kernel that have not all |
| 182 | been removed. This config is intended to be used only while |
| 183 | trying to find such users. |
| 184 | |
Daniel Micay | 0f51310 | 2017-07-12 14:36:10 -0700 | [diff] [blame] | 185 | config FORTIFY_SOURCE |
| 186 | bool "Harden common str/mem functions against buffer overflows" |
| 187 | depends on ARCH_HAS_FORTIFY_SOURCE |
| 188 | help |
| 189 | Detect overflows of buffers in common string and memory functions |
| 190 | where the compiler can determine and validate the buffer sizes. |
| 191 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 192 | source security/selinux/Kconfig |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 193 | source security/smack/Kconfig |
Kentaro Takeda | 00d7d6f | 2009-02-05 17:18:17 +0900 | [diff] [blame] | 194 | source security/tomoyo/Kconfig |
John Johansen | f9ad1af | 2010-07-29 14:48:08 -0700 | [diff] [blame] | 195 | source security/apparmor/Kconfig |
Kees Cook | 9b09155 | 2016-04-20 15:46:28 -0700 | [diff] [blame] | 196 | source security/loadpin/Kconfig |
Kees Cook | 2d51448 | 2011-12-21 12:17:04 -0800 | [diff] [blame] | 197 | source security/yama/Kconfig |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 198 | |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 199 | source security/integrity/Kconfig |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 200 | |
John Johansen | 6e65f92 | 2009-11-05 17:03:20 -0800 | [diff] [blame] | 201 | choice |
| 202 | prompt "Default security module" |
| 203 | default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX |
| 204 | default DEFAULT_SECURITY_SMACK if SECURITY_SMACK |
| 205 | default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO |
John Johansen | f9ad1af | 2010-07-29 14:48:08 -0700 | [diff] [blame] | 206 | default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR |
John Johansen | 6e65f92 | 2009-11-05 17:03:20 -0800 | [diff] [blame] | 207 | default DEFAULT_SECURITY_DAC |
| 208 | |
| 209 | help |
| 210 | Select the security module that will be used by default if the |
| 211 | kernel parameter security= is not specified. |
| 212 | |
| 213 | config DEFAULT_SECURITY_SELINUX |
| 214 | bool "SELinux" if SECURITY_SELINUX=y |
| 215 | |
| 216 | config DEFAULT_SECURITY_SMACK |
| 217 | bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y |
| 218 | |
| 219 | config DEFAULT_SECURITY_TOMOYO |
| 220 | bool "TOMOYO" if SECURITY_TOMOYO=y |
| 221 | |
John Johansen | f9ad1af | 2010-07-29 14:48:08 -0700 | [diff] [blame] | 222 | config DEFAULT_SECURITY_APPARMOR |
| 223 | bool "AppArmor" if SECURITY_APPARMOR=y |
| 224 | |
John Johansen | 6e65f92 | 2009-11-05 17:03:20 -0800 | [diff] [blame] | 225 | config DEFAULT_SECURITY_DAC |
| 226 | bool "Unix Discretionary Access Controls" |
| 227 | |
| 228 | endchoice |
| 229 | |
| 230 | config DEFAULT_SECURITY |
| 231 | string |
| 232 | default "selinux" if DEFAULT_SECURITY_SELINUX |
| 233 | default "smack" if DEFAULT_SECURITY_SMACK |
| 234 | default "tomoyo" if DEFAULT_SECURITY_TOMOYO |
John Johansen | f9ad1af | 2010-07-29 14:48:08 -0700 | [diff] [blame] | 235 | default "apparmor" if DEFAULT_SECURITY_APPARMOR |
John Johansen | 6e65f92 | 2009-11-05 17:03:20 -0800 | [diff] [blame] | 236 | default "" if DEFAULT_SECURITY_DAC |
| 237 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 238 | endmenu |
| 239 | |