Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # Security configuration |
| 3 | # |
| 4 | |
| 5 | menu "Security options" |
| 6 | |
| 7 | config KEYS |
| 8 | bool "Enable access key retention support" |
| 9 | help |
| 10 | This option provides support for retaining authentication tokens and |
| 11 | access keys in the kernel. |
| 12 | |
| 13 | It also includes provision of methods by which such keys might be |
| 14 | associated with a process so that network filesystems, encryption |
| 15 | support and the like can find them. |
| 16 | |
| 17 | Furthermore, a special type of key is available that acts as keyring: |
| 18 | a searchable sequence of keys. Each process is equipped with access |
| 19 | to five standard keyrings: UID-specific, GID-specific, session, |
| 20 | process and thread. |
| 21 | |
| 22 | If you are unsure as to whether this is required, answer N. |
| 23 | |
| 24 | config KEYS_DEBUG_PROC_KEYS |
Michael LeMay | 06ec7be | 2006-06-26 00:24:56 -0700 | [diff] [blame] | 25 | bool "Enable the /proc/keys file by which keys may be viewed" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | depends on KEYS |
| 27 | help |
Michael LeMay | 06ec7be | 2006-06-26 00:24:56 -0700 | [diff] [blame] | 28 | This option turns on support for the /proc/keys file - through which |
| 29 | can be listed all the keys on the system that are viewable by the |
| 30 | reading process. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | |
Michael LeMay | 06ec7be | 2006-06-26 00:24:56 -0700 | [diff] [blame] | 32 | The only keys included in the list are those that grant View |
| 33 | permission to the reading process whether or not it possesses them. |
| 34 | Note that LSM security checks are still performed, and may further |
| 35 | filter out keys that the current process is not authorised to view. |
| 36 | |
| 37 | Only key attributes are listed here; key payloads are not included in |
| 38 | the resulting table. |
| 39 | |
| 40 | If you are unsure as to whether this is required, answer N. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 41 | |
| 42 | config SECURITY |
| 43 | bool "Enable different security models" |
Adrian Bunk | 2c40579 | 2005-08-22 18:20:50 +0200 | [diff] [blame] | 44 | depends on SYSFS |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | help |
| 46 | This allows you to choose different security modules to be |
| 47 | configured into your kernel. |
| 48 | |
| 49 | If this option is not selected, the default Linux security |
| 50 | model will be used. |
| 51 | |
| 52 | If you are unsure how to answer this question, answer N. |
| 53 | |
| 54 | config SECURITY_NETWORK |
| 55 | bool "Socket and Networking Security Hooks" |
| 56 | depends on SECURITY |
| 57 | help |
| 58 | This enables the socket and networking security hooks. |
| 59 | If enabled, a security module can use these hooks to |
| 60 | implement socket and networking access controls. |
| 61 | If you are unsure how to answer this question, answer N. |
| 62 | |
Trent Jaeger | df71837 | 2005-12-13 23:12:27 -0800 | [diff] [blame] | 63 | config SECURITY_NETWORK_XFRM |
| 64 | bool "XFRM (IPSec) Networking Security Hooks" |
| 65 | depends on XFRM && SECURITY_NETWORK |
| 66 | help |
| 67 | This enables the XFRM (IPSec) networking security hooks. |
| 68 | If enabled, a security module can use these hooks to |
| 69 | implement per-packet access controls based on labels |
| 70 | derived from IPSec policy. Non-IPSec communications are |
| 71 | designated as unlabelled, and only sockets authorized |
| 72 | to communicate unlabelled data can send without using |
| 73 | IPSec. |
| 74 | If you are unsure how to answer this question, answer N. |
| 75 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | config SECURITY_CAPABILITIES |
James Morris | 20510f2 | 2007-10-16 23:31:32 -0700 | [diff] [blame] | 77 | bool "Default Linux Capabilities" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | depends on SECURITY |
sergeh@us.ibm.com | f71ea9d | 2008-01-29 05:04:43 -0800 | [diff] [blame^] | 79 | default y |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | help |
| 81 | This enables the "default" Linux capabilities functionality. |
| 82 | If you are unsure how to answer this question, answer Y. |
| 83 | |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 84 | config SECURITY_FILE_CAPABILITIES |
| 85 | bool "File POSIX Capabilities (EXPERIMENTAL)" |
| 86 | depends on (SECURITY=n || SECURITY_CAPABILITIES!=n) && EXPERIMENTAL |
| 87 | default n |
| 88 | help |
| 89 | This enables filesystem capabilities, allowing you to give |
| 90 | binaries a subset of root's powers without using setuid 0. |
| 91 | |
| 92 | If in doubt, answer N. |
| 93 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | config SECURITY_ROOTPLUG |
James Morris | 20510f2 | 2007-10-16 23:31:32 -0700 | [diff] [blame] | 95 | bool "Root Plug Support" |
| 96 | depends on USB=y && SECURITY |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | help |
| 98 | This is a sample LSM module that should only be used as such. |
| 99 | It prevents any programs running with egid == 0 if a specific |
| 100 | USB device is not present in the system. |
| 101 | |
| 102 | See <http://www.linuxjournal.com/article.php?sid=6279> for |
| 103 | more information about this module. |
| 104 | |
| 105 | If you are unsure how to answer this question, answer N. |
| 106 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 107 | source security/selinux/Kconfig |
| 108 | |
| 109 | endmenu |
| 110 | |