| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | config SECURITY_SELINUX |
| 2 | bool "NSA SELinux Support" |
| Stephen Smalley | 99f6d61 | 2006-02-07 12:58:51 -0800 | [diff] [blame^] | 3 | depends on SECURITY_NETWORK && AUDIT && NET && INET |
| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | default n |
| 5 | help |
| 6 | This selects NSA Security-Enhanced Linux (SELinux). |
| 7 | You will also need a policy configuration and a labeled filesystem. |
| 8 | You can obtain the policy compiler (checkpolicy), the utility for |
| 9 | labeling filesystems (setfiles), and an example policy configuration |
| 10 | from <http://www.nsa.gov/selinux/>. |
| 11 | If you are unsure how to answer this question, answer N. |
| 12 | |
| 13 | config SECURITY_SELINUX_BOOTPARAM |
| 14 | bool "NSA SELinux boot parameter" |
| 15 | depends on SECURITY_SELINUX |
| 16 | default n |
| 17 | help |
| 18 | This option adds a kernel parameter 'selinux', which allows SELinux |
| 19 | to be disabled at boot. If this option is selected, SELinux |
| 20 | functionality can be disabled with selinux=0 on the kernel |
| 21 | command line. The purpose of this option is to allow a single |
| 22 | kernel image to be distributed with SELinux built in, but not |
| 23 | necessarily enabled. |
| 24 | |
| 25 | If you are unsure how to answer this question, answer N. |
| 26 | |
| 27 | config SECURITY_SELINUX_BOOTPARAM_VALUE |
| 28 | int "NSA SELinux boot parameter default value" |
| 29 | depends on SECURITY_SELINUX_BOOTPARAM |
| 30 | range 0 1 |
| 31 | default 1 |
| 32 | help |
| 33 | This option sets the default value for the kernel parameter |
| 34 | 'selinux', which allows SELinux to be disabled at boot. If this |
| 35 | option is set to 0 (zero), the SELinux kernel parameter will |
| 36 | default to 0, disabling SELinux at bootup. If this option is |
| 37 | set to 1 (one), the SELinux kernel parameter will default to 1, |
| 38 | enabling SELinux at bootup. |
| 39 | |
| 40 | If you are unsure how to answer this question, answer 1. |
| 41 | |
| 42 | config SECURITY_SELINUX_DISABLE |
| 43 | bool "NSA SELinux runtime disable" |
| 44 | depends on SECURITY_SELINUX |
| 45 | default n |
| 46 | help |
| 47 | This option enables writing to a selinuxfs node 'disable', which |
| 48 | allows SELinux to be disabled at runtime prior to the policy load. |
| 49 | SELinux will then remain disabled until the next boot. |
| 50 | This option is similar to the selinux=0 boot parameter, but is to |
| 51 | support runtime disabling of SELinux, e.g. from /sbin/init, for |
| 52 | portability across platforms where boot parameters are difficult |
| 53 | to employ. |
| 54 | |
| 55 | If you are unsure how to answer this question, answer N. |
| 56 | |
| 57 | config SECURITY_SELINUX_DEVELOP |
| 58 | bool "NSA SELinux Development Support" |
| 59 | depends on SECURITY_SELINUX |
| 60 | default y |
| 61 | help |
| 62 | This enables the development support option of NSA SELinux, |
| 63 | which is useful for experimenting with SELinux and developing |
| 64 | policies. If unsure, say Y. With this option enabled, the |
| 65 | kernel will start in permissive mode (log everything, deny nothing) |
| 66 | unless you specify enforcing=1 on the kernel command line. You |
| 67 | can interactively toggle the kernel between enforcing mode and |
| 68 | permissive mode (if permitted by the policy) via /selinux/enforce. |
| 69 | |
| 70 | config SECURITY_SELINUX_AVC_STATS |
| 71 | bool "NSA SELinux AVC Statistics" |
| 72 | depends on SECURITY_SELINUX |
| 73 | default y |
| 74 | help |
| 75 | This option collects access vector cache statistics to |
| 76 | /selinux/avc/cache_stats, which may be monitored via |
| 77 | tools such as avcstat. |
| 78 | |
| 79 | config SECURITY_SELINUX_CHECKREQPROT_VALUE |
| 80 | int "NSA SELinux checkreqprot default value" |
| 81 | depends on SECURITY_SELINUX |
| 82 | range 0 1 |
| 83 | default 1 |
| 84 | help |
| 85 | This option sets the default value for the 'checkreqprot' flag |
| 86 | that determines whether SELinux checks the protection requested |
| 87 | by the application or the protection that will be applied by the |
| 88 | kernel (including any implied execute for read-implies-exec) for |
| 89 | mmap and mprotect calls. If this option is set to 0 (zero), |
| 90 | SELinux will default to checking the protection that will be applied |
| 91 | by the kernel. If this option is set to 1 (one), SELinux will |
| 92 | default to checking the protection requested by the application. |
| 93 | The checkreqprot flag may be changed from the default via the |
| 94 | 'checkreqprot=' boot parameter. It may also be changed at runtime |
| 95 | via /selinux/checkreqprot if authorized by policy. |
| 96 | |
| 97 | If you are unsure how to answer this question, answer 1. |