projects / mirror_ubuntu-bionic-kernel.git / blame
| Commit | Line | Data |
|---|---|---|
| 1da177e4 LT |
1 | config SECURITY_SELINUX |
| 2 | bool "NSA SELinux Support" | |
| 99f6d61b | 3 | depends on SECURITY_NETWORK && AUDIT && NET && INET |
| 4e5ab4cb | 4 | select NETWORK_SECMARK |
| 1da177e4 LT |
5 | default n |
| 6 | help | |
| 7 | This selects NSA Security-Enhanced Linux (SELinux). | |
| 8 | You will also need a policy configuration and a labeled filesystem. | |
| 1da177e4 LT |
9 | If you are unsure how to answer this question, answer N. |
| 10 | ||
| 11 | config SECURITY_SELINUX_BOOTPARAM | |
| 12 | bool "NSA SELinux boot parameter" | |
| 13 | depends on SECURITY_SELINUX | |
| 14 | default n | |
| 15 | help | |
| 16 | This option adds a kernel parameter 'selinux', which allows SELinux | |
| 17 | to be disabled at boot. If this option is selected, SELinux | |
| 18 | functionality can be disabled with selinux=0 on the kernel | |
| 19 | command line. The purpose of this option is to allow a single | |
| 20 | kernel image to be distributed with SELinux built in, but not | |
| 21 | necessarily enabled. | |
| 22 | ||
| 23 | If you are unsure how to answer this question, answer N. | |
| 24 | ||
| 25 | config SECURITY_SELINUX_BOOTPARAM_VALUE | |
| 26 | int "NSA SELinux boot parameter default value" | |
| 27 | depends on SECURITY_SELINUX_BOOTPARAM | |
| 28 | range 0 1 | |
| 29 | default 1 | |
| 30 | help | |
| 31 | This option sets the default value for the kernel parameter | |
| 32 | 'selinux', which allows SELinux to be disabled at boot. If this | |
| 33 | option is set to 0 (zero), the SELinux kernel parameter will | |
| 34 | default to 0, disabling SELinux at bootup. If this option is | |
| 35 | set to 1 (one), the SELinux kernel parameter will default to 1, | |
| 36 | enabling SELinux at bootup. | |
| 37 | ||
| 38 | If you are unsure how to answer this question, answer 1. | |
| 39 | ||
| 40 | config SECURITY_SELINUX_DISABLE | |
| 41 | bool "NSA SELinux runtime disable" | |
| 42 | depends on SECURITY_SELINUX | |
| dd0859dc | 43 | select SECURITY_WRITABLE_HOOKS |
| 1da177e4 LT |
44 | default n |
| 45 | help | |
| 46 | This option enables writing to a selinuxfs node 'disable', which | |
| 47 | allows SELinux to be disabled at runtime prior to the policy load. | |
| 48 | SELinux will then remain disabled until the next boot. | |
| 49 | This option is similar to the selinux=0 boot parameter, but is to | |
| 50 | support runtime disabling of SELinux, e.g. from /sbin/init, for | |
| 51 | portability across platforms where boot parameters are difficult | |
| 52 | to employ. | |
| 53 | ||
| dd0859dc JM |
54 | NOTE: selecting this option will disable the '__ro_after_init' |
| 55 | kernel hardening feature for security hooks. Please consider | |
| 56 | using the selinux=0 boot parameter instead of enabling this | |
| 57 | option. | |
| 58 | ||
| 1da177e4 LT |
59 | If you are unsure how to answer this question, answer N. |
| 60 | ||
| 61 | config SECURITY_SELINUX_DEVELOP | |
| 62 | bool "NSA SELinux Development Support" | |
| 63 | depends on SECURITY_SELINUX | |
| 64 | default y | |
| 65 | help | |
| 66 | This enables the development support option of NSA SELinux, | |
| 67 | which is useful for experimenting with SELinux and developing | |
| 68 | policies. If unsure, say Y. With this option enabled, the | |
| 69 | kernel will start in permissive mode (log everything, deny nothing) | |
| 70 | unless you specify enforcing=1 on the kernel command line. You | |
| 71 | can interactively toggle the kernel between enforcing mode and | |
| 72 | permissive mode (if permitted by the policy) via /selinux/enforce. | |
| 73 | ||
| 74 | config SECURITY_SELINUX_AVC_STATS | |
| 75 | bool "NSA SELinux AVC Statistics" | |
| 76 | depends on SECURITY_SELINUX | |
| 77 | default y | |
| 78 | help | |
| 79 | This option collects access vector cache statistics to | |
| 80 | /selinux/avc/cache_stats, which may be monitored via | |
| 81 | tools such as avcstat. | |
| 82 | ||
| 83 | config SECURITY_SELINUX_CHECKREQPROT_VALUE | |
| 84 | int "NSA SELinux checkreqprot default value" | |
| 85 | depends on SECURITY_SELINUX | |
| 86 | range 0 1 | |
| 2a35d196 | 87 | default 0 |
| 1da177e4 LT |
88 | help |
| 89 | This option sets the default value for the 'checkreqprot' flag | |
| 90 | that determines whether SELinux checks the protection requested | |
| 91 | by the application or the protection that will be applied by the | |
| 92 | kernel (including any implied execute for read-implies-exec) for | |
| 93 | mmap and mprotect calls. If this option is set to 0 (zero), | |
| 94 | SELinux will default to checking the protection that will be applied | |
| 95 | by the kernel. If this option is set to 1 (one), SELinux will | |
| 96 | default to checking the protection requested by the application. | |
| 97 | The checkreqprot flag may be changed from the default via the | |
| 98 | 'checkreqprot=' boot parameter. It may also be changed at runtime | |
| 99 | via /selinux/checkreqprot if authorized by policy. | |
| 100 | ||
| 2a35d196 | 101 | If you are unsure how to answer this question, answer 0. |