xref: /openbmc/linux/security/Kconfig (revision 4f6cce39)
1#
2# Security configuration
3#
4
5menu "Security options"
6
7source security/keys/Kconfig
8
9config SECURITY_DMESG_RESTRICT
10	bool "Restrict unprivileged access to the kernel syslog"
11	default n
12	help
13	  This enforces restrictions on unprivileged users reading the kernel
14	  syslog via dmesg(8).
15
16	  If this option is not selected, no restrictions will be enforced
17	  unless the dmesg_restrict sysctl is explicitly set to (1).
18
19	  If you are unsure how to answer this question, answer N.
20
21config SECURITY
22	bool "Enable different security models"
23	depends on SYSFS
24	depends on MULTIUSER
25	help
26	  This allows you to choose different security modules to be
27	  configured into your kernel.
28
29	  If this option is not selected, the default Linux security
30	  model will be used.
31
32	  If you are unsure how to answer this question, answer N.
33
34config SECURITYFS
35	bool "Enable the securityfs filesystem"
36	help
37	  This will build the securityfs filesystem.  It is currently used by
38	  the TPM bios character driver and IMA, an integrity provider.  It is
39	  not used by SELinux or SMACK.
40
41	  If you are unsure how to answer this question, answer N.
42
43config SECURITY_NETWORK
44	bool "Socket and Networking Security Hooks"
45	depends on SECURITY
46	help
47	  This enables the socket and networking security hooks.
48	  If enabled, a security module can use these hooks to
49	  implement socket and networking access controls.
50	  If you are unsure how to answer this question, answer N.
51
52config SECURITY_NETWORK_XFRM
53	bool "XFRM (IPSec) Networking Security Hooks"
54	depends on XFRM && SECURITY_NETWORK
55	help
56	  This enables the XFRM (IPSec) networking security hooks.
57	  If enabled, a security module can use these hooks to
58	  implement per-packet access controls based on labels
59	  derived from IPSec policy.  Non-IPSec communications are
60	  designated as unlabelled, and only sockets authorized
61	  to communicate unlabelled data can send without using
62	  IPSec.
63	  If you are unsure how to answer this question, answer N.
64
65config SECURITY_PATH
66	bool "Security hooks for pathname based access control"
67	depends on SECURITY
68	help
69	  This enables the security hooks for pathname based access control.
70	  If enabled, a security module can use these hooks to
71	  implement pathname based access controls.
72	  If you are unsure how to answer this question, answer N.
73
74config INTEL_TXT
75	bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
76	depends on HAVE_INTEL_TXT
77	help
78	  This option enables support for booting the kernel with the
79	  Trusted Boot (tboot) module. This will utilize
80	  Intel(R) Trusted Execution Technology to perform a measured launch
81	  of the kernel. If the system does not support Intel(R) TXT, this
82	  will have no effect.
83
84	  Intel TXT will provide higher assurance of system configuration and
85	  initial state as well as data reset protection.  This is used to
86	  create a robust initial kernel measurement and verification, which
87	  helps to ensure that kernel security mechanisms are functioning
88	  correctly. This level of protection requires a root of trust outside
89	  of the kernel itself.
90
91	  Intel TXT also helps solve real end user concerns about having
92	  confidence that their hardware is running the VMM or kernel that
93	  it was configured with, especially since they may be responsible for
94	  providing such assurances to VMs and services running on it.
95
96	  See <http://www.intel.com/technology/security/> for more information
97	  about Intel(R) TXT.
98	  See <http://tboot.sourceforge.net> for more information about tboot.
99	  See Documentation/intel_txt.txt for a description of how to enable
100	  Intel TXT support in a kernel boot.
101
102	  If you are unsure as to whether this is required, answer N.
103
104config LSM_MMAP_MIN_ADDR
105	int "Low address space for LSM to protect from user allocation"
106	depends on SECURITY && SECURITY_SELINUX
107	default 32768 if ARM || (ARM64 && COMPAT)
108	default 65536
109	help
110	  This is the portion of low virtual memory which should be protected
111	  from userspace allocation.  Keeping a user from writing to low pages
112	  can help reduce the impact of kernel NULL pointer bugs.
113
114	  For most ia64, ppc64 and x86 users with lots of address space
115	  a value of 65536 is reasonable and should cause no problems.
116	  On arm and other archs it should not be higher than 32768.
117	  Programs which use vm86 functionality or have some need to map
118	  this low address space will need the permission specific to the
119	  systems running LSM.
120
121config HAVE_HARDENED_USERCOPY_ALLOCATOR
122	bool
123	help
124	  The heap allocator implements __check_heap_object() for
125	  validating memory ranges against heap object sizes in
126	  support of CONFIG_HARDENED_USERCOPY.
127
128config HAVE_ARCH_HARDENED_USERCOPY
129	bool
130	help
131	  The architecture supports CONFIG_HARDENED_USERCOPY by
132	  calling check_object_size() just before performing the
133	  userspace copies in the low level implementation of
134	  copy_to_user() and copy_from_user().
135
136config HARDENED_USERCOPY
137	bool "Harden memory copies between kernel and userspace"
138	depends on HAVE_ARCH_HARDENED_USERCOPY
139	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
140	select BUG
141	help
142	  This option checks for obviously wrong memory regions when
143	  copying memory to/from the kernel (via copy_to_user() and
144	  copy_from_user() functions) by rejecting memory ranges that
145	  are larger than the specified heap object, span multiple
146	  separately allocates pages, are not on the process stack,
147	  or are part of the kernel text. This kills entire classes
148	  of heap overflow exploits and similar kernel memory exposures.
149
150config HARDENED_USERCOPY_PAGESPAN
151	bool "Refuse to copy allocations that span multiple pages"
152	depends on HARDENED_USERCOPY
153	depends on EXPERT
154	help
155	  When a multi-page allocation is done without __GFP_COMP,
156	  hardened usercopy will reject attempts to copy it. There are,
157	  however, several cases of this in the kernel that have not all
158	  been removed. This config is intended to be used only while
159	  trying to find such users.
160
161config STATIC_USERMODEHELPER
162	bool "Force all usermode helper calls through a single binary"
163	help
164	  By default, the kernel can call many different userspace
165	  binary programs through the "usermode helper" kernel
166	  interface.  Some of these binaries are statically defined
167	  either in the kernel code itself, or as a kernel configuration
168	  option.  However, some of these are dynamically created at
169	  runtime, or can be modified after the kernel has started up.
170	  To provide an additional layer of security, route all of these
171	  calls through a single executable that can not have its name
172	  changed.
173
174	  Note, it is up to this single binary to then call the relevant
175	  "real" usermode helper binary, based on the first argument
176	  passed to it.  If desired, this program can filter and pick
177	  and choose what real programs are called.
178
179	  If you wish for all usermode helper programs are to be
180	  disabled, choose this option and then set
181	  STATIC_USERMODEHELPER_PATH to an empty string.
182
183config STATIC_USERMODEHELPER_PATH
184	string "Path to the static usermode helper binary"
185	depends on STATIC_USERMODEHELPER
186	default "/sbin/usermode-helper"
187	help
188	  The binary called by the kernel when any usermode helper
189	  program is wish to be run.  The "real" application's name will
190	  be in the first argument passed to this program on the command
191	  line.
192
193	  If you wish for all usermode helper programs to be disabled,
194	  specify an empty string here (i.e. "").
195
196source security/selinux/Kconfig
197source security/smack/Kconfig
198source security/tomoyo/Kconfig
199source security/apparmor/Kconfig
200source security/loadpin/Kconfig
201source security/yama/Kconfig
202
203source security/integrity/Kconfig
204
205choice
206	prompt "Default security module"
207	default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
208	default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
209	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
210	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
211	default DEFAULT_SECURITY_DAC
212
213	help
214	  Select the security module that will be used by default if the
215	  kernel parameter security= is not specified.
216
217	config DEFAULT_SECURITY_SELINUX
218		bool "SELinux" if SECURITY_SELINUX=y
219
220	config DEFAULT_SECURITY_SMACK
221		bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
222
223	config DEFAULT_SECURITY_TOMOYO
224		bool "TOMOYO" if SECURITY_TOMOYO=y
225
226	config DEFAULT_SECURITY_APPARMOR
227		bool "AppArmor" if SECURITY_APPARMOR=y
228
229	config DEFAULT_SECURITY_DAC
230		bool "Unix Discretionary Access Controls"
231
232endchoice
233
234config DEFAULT_SECURITY
235	string
236	default "selinux" if DEFAULT_SECURITY_SELINUX
237	default "smack" if DEFAULT_SECURITY_SMACK
238	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
239	default "apparmor" if DEFAULT_SECURITY_APPARMOR
240	default "" if DEFAULT_SECURITY_DAC
241
242endmenu
243
244