security/Kconfig

   1 #
   2 # Security configuration
   3 #
   4
   5 menu "Security options"
   6
   7 source security/keys/Kconfig
   8
   9 config SECURITY_DMESG_RESTRICT
  10         bool "Restrict unprivileged access to the kernel syslog"
  11         default n
  12         help
  13           This enforces restrictions on unprivileged users reading the kernel
  14           syslog via dmesg(8).
  15
  16           If this option is not selected, no restrictions will be enforced
  17           unless the dmesg_restrict sysctl is explicitly set to (1).
  18
  19           If you are unsure how to answer this question, answer N.
  20
  21 config SECURITY_PERF_EVENTS_RESTRICT
  22         bool "Restrict unprivileged use of performance events"
  23         depends on PERF_EVENTS
  24         help
  25           If you say Y here, the kernel.perf_event_paranoid sysctl
  26           will be set to 3 by default, and no unprivileged use of the
  27           perf_event_open syscall will be permitted unless it is
  28           changed.
  29
  30 config SECURITY
  31         bool "Enable different security models"
  32         depends on SYSFS
  33         depends on MULTIUSER
  34         help
  35           This allows you to choose different security modules to be
  36           configured into your kernel.
  37
  38           If this option is not selected, the default Linux security
  39           model will be used.
  40
  41           If you are unsure how to answer this question, answer N.
  42
  43 config SECURITY_WRITABLE_HOOKS
  44         depends on SECURITY
  45         bool
  46         default n
  47
  48 config SECURITY_STACKING
  49         bool "Security module stacking"
  50         depends on SECURITY
  51         help
  52           Allows multiple major security modules to be stacked.
  53           Modules are invoked in the order registered with a
  54           "bail on fail" policy, in which the infrastructure
  55           will stop processing once a denial is detected. Not
  56           all modules can be stacked. SELinux and Smack are
  57           known to be incompatible. User space components may
  58           have trouble identifying the security module providing
  59           data in some cases.
  60
  61           If you select this option you will have to select which
  62           of the stackable modules you wish to be active. The
  63           "Default security module" will be ignored. The boot line
  64           "security=" option can be used to specify that one of
  65           the modules identifed for stacking should be used instead
  66           of the entire stack.
  67
  68           If you are unsure how to answer this question, answer N.
  69
  70 config SECURITY_LSM_DEBUG
  71         bool "Enable debugging of the LSM infrastructure"
  72         depends on SECURITY
  73         help
  74           This allows you to choose debug messages related to
  75           security modules configured into your kernel. These
  76           messages may be helpful in determining how a security
  77           module is using security blobs.
  78
  79           If you are unsure how to answer this question, answer N.
  80
  81 config SECURITYFS
  82         bool "Enable the securityfs filesystem"
  83         help
  84           This will build the securityfs filesystem.  It is currently used by
  85           the TPM bios character driver and IMA, an integrity provider.  It is
  86           not used by SELinux or SMACK.
  87
  88           If you are unsure how to answer this question, answer N.
  89
  90 config SECURITY_NETWORK
  91         bool "Socket and Networking Security Hooks"
  92         depends on SECURITY
  93         help
  94           This enables the socket and networking security hooks.
  95           If enabled, a security module can use these hooks to
  96           implement socket and networking access controls.
  97           If you are unsure how to answer this question, answer N.
  98
  99 config PAGE_TABLE_ISOLATION
 100         bool "Remove the kernel mapping in user mode"
 101         default y
 102         depends on X86_64 && !UML
 103         help
 104           This feature reduces the number of hardware side channels by
 105           ensuring that the majority of kernel addresses are not mapped
 106           into userspace.
 107
 108           See Documentation/x86/pti.txt for more details.
 109
 110 config SECURITY_INFINIBAND
 111         bool "Infiniband Security Hooks"
 112         depends on SECURITY && INFINIBAND
 113         help
 114           This enables the Infiniband security hooks.
 115           If enabled, a security module can use these hooks to
 116           implement Infiniband access controls.
 117           If you are unsure how to answer this question, answer N.
 118
 119 config SECURITY_NETWORK_XFRM
 120         bool "XFRM (IPSec) Networking Security Hooks"
 121         depends on XFRM && SECURITY_NETWORK
 122         help
 123           This enables the XFRM (IPSec) networking security hooks.
 124           If enabled, a security module can use these hooks to
 125           implement per-packet access controls based on labels
 126           derived from IPSec policy.  Non-IPSec communications are
 127           designated as unlabelled, and only sockets authorized
 128           to communicate unlabelled data can send without using
 129           IPSec.
 130           If you are unsure how to answer this question, answer N.
 131
 132 config SECURITY_PATH
 133         bool "Security hooks for pathname based access control"
 134         depends on SECURITY
 135         help
 136           This enables the security hooks for pathname based access control.
 137           If enabled, a security module can use these hooks to
 138           implement pathname based access controls.
 139           If you are unsure how to answer this question, answer N.
 140
 141 config INTEL_TXT
 142         bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
 143         depends on HAVE_INTEL_TXT
 144         help
 145           This option enables support for booting the kernel with the
 146           Trusted Boot (tboot) module. This will utilize
 147           Intel(R) Trusted Execution Technology to perform a measured launch
 148           of the kernel. If the system does not support Intel(R) TXT, this
 149           will have no effect.
 150
 151           Intel TXT will provide higher assurance of system configuration and
 152           initial state as well as data reset protection.  This is used to
 153           create a robust initial kernel measurement and verification, which
 154           helps to ensure that kernel security mechanisms are functioning
 155           correctly. This level of protection requires a root of trust outside
 156           of the kernel itself.
 157
 158           Intel TXT also helps solve real end user concerns about having
 159           confidence that their hardware is running the VMM or kernel that
 160           it was configured with, especially since they may be responsible for
 161           providing such assurances to VMs and services running on it.
 162
 163           See <http://www.intel.com/technology/security/> for more information
 164           about Intel(R) TXT.
 165           See <http://tboot.sourceforge.net> for more information about tboot.
 166           See Documentation/intel_txt.txt for a description of how to enable
 167           Intel TXT support in a kernel boot.
 168
 169           If you are unsure as to whether this is required, answer N.
 170
 171 config LSM_MMAP_MIN_ADDR
 172         int "Low address space for LSM to protect from user allocation"
 173         depends on SECURITY && SECURITY_SELINUX
 174         default 32768 if ARM || (ARM64 && COMPAT)
 175         default 65536
 176         help
 177           This is the portion of low virtual memory which should be protected
 178           from userspace allocation.  Keeping a user from writing to low pages
 179           can help reduce the impact of kernel NULL pointer bugs.
 180
 181           For most ia64, ppc64 and x86 users with lots of address space
 182           a value of 65536 is reasonable and should cause no problems.
 183           On arm and other archs it should not be higher than 32768.
 184           Programs which use vm86 functionality or have some need to map
 185           this low address space will need the permission specific to the
 186           systems running LSM.
 187
 188 config HAVE_HARDENED_USERCOPY_ALLOCATOR
 189         bool
 190         help
 191           The heap allocator implements __check_heap_object() for
 192           validating memory ranges against heap object sizes in
 193           support of CONFIG_HARDENED_USERCOPY.
 194
 195 config HARDENED_USERCOPY
 196         bool "Harden memory copies between kernel and userspace"
 197         depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
 198         select BUG
 199         imply STRICT_DEVMEM
 200         help
 201           This option checks for obviously wrong memory regions when
 202           copying memory to/from the kernel (via copy_to_user() and
 203           copy_from_user() functions) by rejecting memory ranges that
 204           are larger than the specified heap object, span multiple
 205           separately allocated pages, are not on the process stack,
 206           or are part of the kernel text. This kills entire classes
 207           of heap overflow exploits and similar kernel memory exposures.
 208
 209 config HARDENED_USERCOPY_PAGESPAN
 210         bool "Refuse to copy allocations that span multiple pages"
 211         depends on HARDENED_USERCOPY
 212         depends on EXPERT
 213         help
 214           When a multi-page allocation is done without __GFP_COMP,
 215           hardened usercopy will reject attempts to copy it. There are,
 216           however, several cases of this in the kernel that have not all
 217           been removed. This config is intended to be used only while
 218           trying to find such users.
 219
 220 config FORTIFY_SOURCE
 221         bool "Harden common str/mem functions against buffer overflows"
 222         depends on ARCH_HAS_FORTIFY_SOURCE
 223         help
 224           Detect overflows of buffers in common string and memory functions
 225           where the compiler can determine and validate the buffer sizes.
 226
 227 config STATIC_USERMODEHELPER
 228         bool "Force all usermode helper calls through a single binary"
 229         help
 230           By default, the kernel can call many different userspace
 231           binary programs through the "usermode helper" kernel
 232           interface.  Some of these binaries are statically defined
 233           either in the kernel code itself, or as a kernel configuration
 234           option.  However, some of these are dynamically created at
 235           runtime, or can be modified after the kernel has started up.
 236           To provide an additional layer of security, route all of these
 237           calls through a single executable that can not have its name
 238           changed.
 239
 240           Note, it is up to this single binary to then call the relevant
 241           "real" usermode helper binary, based on the first argument
 242           passed to it.  If desired, this program can filter and pick
 243           and choose what real programs are called.
 244
 245           If you wish for all usermode helper programs are to be
 246           disabled, choose this option and then set
 247           STATIC_USERMODEHELPER_PATH to an empty string.
 248
 249 config STATIC_USERMODEHELPER_PATH
 250         string "Path to the static usermode helper binary"
 251         depends on STATIC_USERMODEHELPER
 252         default "/sbin/usermode-helper"
 253         help
 254           The binary called by the kernel when any usermode helper
 255           program is wish to be run.  The "real" application's name will
 256           be in the first argument passed to this program on the command
 257           line.
 258
 259           If you wish for all usermode helper programs to be disabled,
 260           specify an empty string here (i.e. "").
 261
 262 config LOCK_DOWN_KERNEL
 263         bool "Allow the kernel to be 'locked down'"
 264         help
 265           Allow the kernel to be locked down under certain circumstances, for
 266           instance if UEFI secure boot is enabled.  Locking down the kernel
 267           turns off various features that might otherwise allow access to the
 268           kernel image (eg. setting MSR registers).
 269
 270 config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
 271         bool "Allow the kernel lockdown to be lifted by SysRq"
 272         depends on LOCK_DOWN_KERNEL && MAGIC_SYSRQ
 273         help
 274           Allow the lockdown on a kernel to be lifted, by pressing a SysRq key
 275           combination on a wired keyboard.
 276
 277 config LOCK_DOWN_IN_EFI_SECURE_BOOT
 278         bool "Lock down the kernel in EFI Secure Boot mode"
 279         default n
 280         select LOCK_DOWN_KERNEL
 281         depends on EFI
 282         help
 283           UEFI Secure Boot provides a mechanism for ensuring that the firmware
 284           will only load signed bootloaders and kernels.  Secure boot mode may
 285           be determined from EFI variables provided by the system firmware if
 286           not indicated by the boot parameters.
 287
 288           Enabling this option turns on results in kernel lockdown being
 289           triggered if EFI Secure Boot is set.
 290
 291
 292 source security/selinux/Kconfig
 293 source security/smack/Kconfig
 294 source security/tomoyo/Kconfig
 295 source security/apparmor/Kconfig
 296 source security/loadpin/Kconfig
 297 source security/yama/Kconfig
 298
 299 source security/integrity/Kconfig
 300
 301 menu "Security Module Selection"
 302         visible if !SECURITY_STACKING
 303
 304 choice
 305         prompt "Default security module"
 306         default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
 307         default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
 308         default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
 309         default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
 310         default DEFAULT_SECURITY_DAC
 311
 312         help
 313           Select the security module that will be used by default if the
 314           kernel parameter security= is not specified.
 315
 316         config DEFAULT_SECURITY_SELINUX
 317                 bool "SELinux" if SECURITY_SELINUX=y
 318
 319         config DEFAULT_SECURITY_SMACK
 320                 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
 321
 322         config DEFAULT_SECURITY_TOMOYO
 323                 bool "TOMOYO" if SECURITY_TOMOYO=y
 324
 325         config DEFAULT_SECURITY_APPARMOR
 326                 bool "AppArmor" if SECURITY_APPARMOR=y
 327
 328         config DEFAULT_SECURITY_DAC
 329                 bool "Unix Discretionary Access Controls"
 330
 331 endchoice
 332
 333 config DEFAULT_SECURITY
 334         string
 335         default "selinux" if DEFAULT_SECURITY_SELINUX
 336         default "smack" if DEFAULT_SECURITY_SMACK
 337         default "tomoyo" if DEFAULT_SECURITY_TOMOYO
 338         default "apparmor" if DEFAULT_SECURITY_APPARMOR
 339         default "" if DEFAULT_SECURITY_DAC
 340
 341 endmenu
 342
 343 menu "Security Module Stack"
 344         visible if SECURITY_STACKING
 345
 346 choice
 347         prompt "Stacked 'extreme' security module"
 348         default SECURITY_SELINUX_STACKED if SECURITY_SELINUX
 349         default SECURITY_SMACK_STACKED if SECURITY_SMACK
 350         default SECURITY_APPARMOR_STACKED if SECURITY_APPARMOR
 351
 352         help
 353           Enable an extreme security module. These modules cannot
 354           be used at the same time.
 355
 356         config SECURITY_SELINUX_STACKED
 357                 bool "SELinux" if SECURITY_SELINUX=y
 358         help
 359           This option instructs the system to use the SELinux checks.
 360           At this time the Smack security module is incompatible with this
 361           module.
 362           At this time the AppArmor security module is incompatible with this
 363           module.
 364
 365         config SECURITY_SMACK_STACKED
 366                 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
 367         help
 368           This option instructs the system to use the Smack checks.
 369           At this time the SELinux security module is incompatible with this
 370           module.
 371           At this time the AppArmor security module is incompatible with this
 372           module.
 373
 374         config SECURITY_APPARMOR_STACKED
 375                 bool "AppArmor" if SECURITY_APPARMOR=y
 376         help
 377           This option instructs the system to use the AppArmor checks.
 378           At this time the SELinux security module is incompatible with this
 379           module.
 380           At this time the Smack security module is incompatible with this
 381           module.
 382
 383         config SECURITY_NOTHING_STACKED
 384                 bool "Use no 'extreme' security module"
 385         help
 386           Use none of the SELinux, Smack or AppArmor security module.
 387
 388 endchoice
 389
 390 config SECURITY_TOMOYO_STACKED
 391         bool "TOMOYO support is enabled by default"
 392         depends on SECURITY_TOMOYO && SECURITY_STACKING
 393         default n
 394         help
 395           This option instructs the system to use the TOMOYO checks.
 396           If not selected the module will not be invoked.
 397           Stacked security modules may interact in unexpected ways.
 398
 399           If you are unsure how to answer this question, answer N.
 400
 401 endmenu
 402
 403 endmenu