]>
Commit | Line | Data |
---|---|---|
ec8f24b7 | 1 | # SPDX-License-Identifier: GPL-2.0-only |
1da177e4 LT |
2 | config SECURITY_SELINUX |
3 | bool "NSA SELinux Support" | |
99f6d61b | 4 | depends on SECURITY_NETWORK && AUDIT && NET && INET |
4e5ab4cb | 5 | select NETWORK_SECMARK |
1da177e4 LT |
6 | default n |
7 | help | |
8 | This selects NSA Security-Enhanced Linux (SELinux). | |
9 | You will also need a policy configuration and a labeled filesystem. | |
1da177e4 LT |
10 | If you are unsure how to answer this question, answer N. |
11 | ||
12 | config SECURITY_SELINUX_BOOTPARAM | |
13 | bool "NSA SELinux boot parameter" | |
14 | depends on SECURITY_SELINUX | |
15 | default n | |
16 | help | |
17 | This option adds a kernel parameter 'selinux', which allows SELinux | |
18 | to be disabled at boot. If this option is selected, SELinux | |
19 | functionality can be disabled with selinux=0 on the kernel | |
20 | command line. The purpose of this option is to allow a single | |
21 | kernel image to be distributed with SELinux built in, but not | |
22 | necessarily enabled. | |
23 | ||
24 | If you are unsure how to answer this question, answer N. | |
25 | ||
1da177e4 LT |
26 | config SECURITY_SELINUX_DISABLE |
27 | bool "NSA SELinux runtime disable" | |
28 | depends on SECURITY_SELINUX | |
dd0859dc | 29 | select SECURITY_WRITABLE_HOOKS |
1da177e4 LT |
30 | default n |
31 | help | |
32 | This option enables writing to a selinuxfs node 'disable', which | |
33 | allows SELinux to be disabled at runtime prior to the policy load. | |
34 | SELinux will then remain disabled until the next boot. | |
35 | This option is similar to the selinux=0 boot parameter, but is to | |
36 | support runtime disabling of SELinux, e.g. from /sbin/init, for | |
37 | portability across platforms where boot parameters are difficult | |
38 | to employ. | |
39 | ||
dd0859dc JM |
40 | NOTE: selecting this option will disable the '__ro_after_init' |
41 | kernel hardening feature for security hooks. Please consider | |
42 | using the selinux=0 boot parameter instead of enabling this | |
43 | option. | |
44 | ||
89b223bf PM |
45 | WARNING: this option is deprecated and will be removed in a future |
46 | kernel release. | |
47 | ||
1da177e4 LT |
48 | If you are unsure how to answer this question, answer N. |
49 | ||
50 | config SECURITY_SELINUX_DEVELOP | |
51 | bool "NSA SELinux Development Support" | |
52 | depends on SECURITY_SELINUX | |
53 | default y | |
54 | help | |
55 | This enables the development support option of NSA SELinux, | |
56 | which is useful for experimenting with SELinux and developing | |
57 | policies. If unsure, say Y. With this option enabled, the | |
58 | kernel will start in permissive mode (log everything, deny nothing) | |
59 | unless you specify enforcing=1 on the kernel command line. You | |
60 | can interactively toggle the kernel between enforcing mode and | |
d41415eb SS |
61 | permissive mode (if permitted by the policy) via |
62 | /sys/fs/selinux/enforce. | |
1da177e4 LT |
63 | |
64 | config SECURITY_SELINUX_AVC_STATS | |
65 | bool "NSA SELinux AVC Statistics" | |
66 | depends on SECURITY_SELINUX | |
67 | default y | |
68 | help | |
69 | This option collects access vector cache statistics to | |
d41415eb | 70 | /sys/fs/selinux/avc/cache_stats, which may be monitored via |
1da177e4 LT |
71 | tools such as avcstat. |
72 | ||
73 | config SECURITY_SELINUX_CHECKREQPROT_VALUE | |
74 | int "NSA SELinux checkreqprot default value" | |
75 | depends on SECURITY_SELINUX | |
76 | range 0 1 | |
2a35d196 | 77 | default 0 |
1da177e4 LT |
78 | help |
79 | This option sets the default value for the 'checkreqprot' flag | |
80 | that determines whether SELinux checks the protection requested | |
81 | by the application or the protection that will be applied by the | |
82 | kernel (including any implied execute for read-implies-exec) for | |
83 | mmap and mprotect calls. If this option is set to 0 (zero), | |
84 | SELinux will default to checking the protection that will be applied | |
85 | by the kernel. If this option is set to 1 (one), SELinux will | |
86 | default to checking the protection requested by the application. | |
87 | The checkreqprot flag may be changed from the default via the | |
88 | 'checkreqprot=' boot parameter. It may also be changed at runtime | |
d41415eb | 89 | via /sys/fs/selinux/checkreqprot if authorized by policy. |
1da177e4 | 90 | |
e9c38f9f SS |
91 | WARNING: this option is deprecated and will be removed in a future |
92 | kernel release. | |
93 | ||
2a35d196 | 94 | If you are unsure how to answer this question, answer 0. |
66f8e2f0 JVS |
95 | |
96 | config SECURITY_SELINUX_SIDTAB_HASH_BITS | |
97 | int "NSA SELinux sidtab hashtable size" | |
98 | depends on SECURITY_SELINUX | |
99 | range 8 13 | |
100 | default 9 | |
101 | help | |
102 | This option sets the number of buckets used in the sidtab hashtable | |
103 | to 2^SECURITY_SELINUX_SIDTAB_HASH_BITS buckets. The number of hash | |
104 | collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If | |
105 | chain lengths are high (e.g. > 20) then selecting a higher value here | |
106 | will ensure that lookups times are short and stable. | |
d97bd23c OM |
107 | |
108 | config SECURITY_SELINUX_SID2STR_CACHE_SIZE | |
109 | int "NSA SELinux SID to context string translation cache size" | |
110 | depends on SECURITY_SELINUX | |
111 | default 256 | |
112 | help | |
113 | This option defines the size of the internal SID -> context string | |
114 | cache, which improves the performance of context to string | |
115 | conversion. Setting this option to 0 disables the cache completely. | |
116 | ||
117 | If unsure, keep the default value. |