2 # Security configuration
5 menu "Security options"
7 source security/keys/Kconfig
9 config SECURITY_DMESG_RESTRICT
10 bool "Restrict unprivileged access to the kernel syslog"
13 This enforces restrictions on unprivileged users reading the kernel
16 If this option is not selected, no restrictions will be enforced
17 unless the dmesg_restrict sysctl is explicitly set to (1).
19 If you are unsure how to answer this question, answer N.
21 config SECURITY_PERF_EVENTS_RESTRICT
22 bool "Restrict unprivileged use of performance events"
23 depends on PERF_EVENTS
25 If you say Y here, the kernel.perf_event_paranoid sysctl
26 will be set to 3 by default, and no unprivileged use of the
27 perf_event_open syscall will be permitted unless it is
31 bool "Enable different security models"
35 This allows you to choose different security modules to be
36 configured into your kernel.
38 If this option is not selected, the default Linux security
41 If you are unsure how to answer this question, answer N.
44 bool "Enable the securityfs filesystem"
46 This will build the securityfs filesystem. It is currently used by
47 the TPM bios character driver and IMA, an integrity provider. It is
48 not used by SELinux or SMACK.
50 If you are unsure how to answer this question, answer N.
52 config SECURITY_NETWORK
53 bool "Socket and Networking Security Hooks"
56 This enables the socket and networking security hooks.
57 If enabled, a security module can use these hooks to
58 implement socket and networking access controls.
59 If you are unsure how to answer this question, answer N.
61 config SECURITY_NETWORK_XFRM
62 bool "XFRM (IPSec) Networking Security Hooks"
63 depends on XFRM && SECURITY_NETWORK
65 This enables the XFRM (IPSec) networking security hooks.
66 If enabled, a security module can use these hooks to
67 implement per-packet access controls based on labels
68 derived from IPSec policy. Non-IPSec communications are
69 designated as unlabelled, and only sockets authorized
70 to communicate unlabelled data can send without using
72 If you are unsure how to answer this question, answer N.
75 bool "Security hooks for pathname based access control"
78 This enables the security hooks for pathname based access control.
79 If enabled, a security module can use these hooks to
80 implement pathname based access controls.
81 If you are unsure how to answer this question, answer N.
84 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
85 depends on HAVE_INTEL_TXT
87 This option enables support for booting the kernel with the
88 Trusted Boot (tboot) module. This will utilize
89 Intel(R) Trusted Execution Technology to perform a measured launch
90 of the kernel. If the system does not support Intel(R) TXT, this
93 Intel TXT will provide higher assurance of system configuration and
94 initial state as well as data reset protection. This is used to
95 create a robust initial kernel measurement and verification, which
96 helps to ensure that kernel security mechanisms are functioning
97 correctly. This level of protection requires a root of trust outside
100 Intel TXT also helps solve real end user concerns about having
101 confidence that their hardware is running the VMM or kernel that
102 it was configured with, especially since they may be responsible for
103 providing such assurances to VMs and services running on it.
105 See <http://www.intel.com/technology/security/> for more information
107 See <http://tboot.sourceforge.net> for more information about tboot.
108 See Documentation/intel_txt.txt for a description of how to enable
109 Intel TXT support in a kernel boot.
111 If you are unsure as to whether this is required, answer N.
113 config LSM_MMAP_MIN_ADDR
114 int "Low address space for LSM to protect from user allocation"
115 depends on SECURITY && SECURITY_SELINUX
116 default 32768 if ARM || (ARM64 && COMPAT)
119 This is the portion of low virtual memory which should be protected
120 from userspace allocation. Keeping a user from writing to low pages
121 can help reduce the impact of kernel NULL pointer bugs.
123 For most ia64, ppc64 and x86 users with lots of address space
124 a value of 65536 is reasonable and should cause no problems.
125 On arm and other archs it should not be higher than 32768.
126 Programs which use vm86 functionality or have some need to map
127 this low address space will need the permission specific to the
130 config HAVE_HARDENED_USERCOPY_ALLOCATOR
133 The heap allocator implements __check_heap_object() for
134 validating memory ranges against heap object sizes in
135 support of CONFIG_HARDENED_USERCOPY.
137 config HAVE_ARCH_HARDENED_USERCOPY
140 The architecture supports CONFIG_HARDENED_USERCOPY by
141 calling check_object_size() just before performing the
142 userspace copies in the low level implementation of
143 copy_to_user() and copy_from_user().
145 config HARDENED_USERCOPY
146 bool "Harden memory copies between kernel and userspace"
147 depends on HAVE_ARCH_HARDENED_USERCOPY
148 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
151 This option checks for obviously wrong memory regions when
152 copying memory to/from the kernel (via copy_to_user() and
153 copy_from_user() functions) by rejecting memory ranges that
154 are larger than the specified heap object, span multiple
155 separately allocates pages, are not on the process stack,
156 or are part of the kernel text. This kills entire classes
157 of heap overflow exploits and similar kernel memory exposures.
159 config HARDENED_USERCOPY_PAGESPAN
160 bool "Refuse to copy allocations that span multiple pages"
161 depends on HARDENED_USERCOPY
162 depends on !COMPILE_TEST
164 When a multi-page allocation is done without __GFP_COMP,
165 hardened usercopy will reject attempts to copy it. There are,
166 however, several cases of this in the kernel that have not all
167 been removed. This config is intended to be used only while
168 trying to find such users.
170 source security/selinux/Kconfig
171 source security/smack/Kconfig
172 source security/tomoyo/Kconfig
173 source security/apparmor/Kconfig
174 source security/yama/Kconfig
176 source security/integrity/Kconfig
179 prompt "Default security module"
180 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
181 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
182 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
183 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
184 default DEFAULT_SECURITY_DAC
187 Select the security module that will be used by default if the
188 kernel parameter security= is not specified.
190 config DEFAULT_SECURITY_SELINUX
191 bool "SELinux" if SECURITY_SELINUX=y
193 config DEFAULT_SECURITY_SMACK
194 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
196 config DEFAULT_SECURITY_TOMOYO
197 bool "TOMOYO" if SECURITY_TOMOYO=y
199 config DEFAULT_SECURITY_APPARMOR
200 bool "AppArmor" if SECURITY_APPARMOR=y
202 config DEFAULT_SECURITY_DAC
203 bool "Unix Discretionary Access Controls"
207 config DEFAULT_SECURITY
209 default "selinux" if DEFAULT_SECURITY_SELINUX
210 default "smack" if DEFAULT_SECURITY_SMACK
211 default "tomoyo" if DEFAULT_SECURITY_TOMOYO
212 default "apparmor" if DEFAULT_SECURITY_APPARMOR
213 default "" if DEFAULT_SECURITY_DAC