xref: /openbmc/linux/security/Kconfig (revision 6dfcd296)
1#
2# Security configuration
3#
4
5menu "Security options"
6
7source security/keys/Kconfig
8
9config SECURITY_DMESG_RESTRICT
10	bool "Restrict unprivileged access to the kernel syslog"
11	default n
12	help
13	  This enforces restrictions on unprivileged users reading the kernel
14	  syslog via dmesg(8).
15
16	  If this option is not selected, no restrictions will be enforced
17	  unless the dmesg_restrict sysctl is explicitly set to (1).
18
19	  If you are unsure how to answer this question, answer N.
20
21config SECURITY
22	bool "Enable different security models"
23	depends on SYSFS
24	depends on MULTIUSER
25	help
26	  This allows you to choose different security modules to be
27	  configured into your kernel.
28
29	  If this option is not selected, the default Linux security
30	  model will be used.
31
32	  If you are unsure how to answer this question, answer N.
33
34config SECURITYFS
35	bool "Enable the securityfs filesystem"
36	help
37	  This will build the securityfs filesystem.  It is currently used by
38	  the TPM bios character driver and IMA, an integrity provider.  It is
39	  not used by SELinux or SMACK.
40
41	  If you are unsure how to answer this question, answer N.
42
43config SECURITY_NETWORK
44	bool "Socket and Networking Security Hooks"
45	depends on SECURITY
46	help
47	  This enables the socket and networking security hooks.
48	  If enabled, a security module can use these hooks to
49	  implement socket and networking access controls.
50	  If you are unsure how to answer this question, answer N.
51
52config SECURITY_NETWORK_XFRM
53	bool "XFRM (IPSec) Networking Security Hooks"
54	depends on XFRM && SECURITY_NETWORK
55	help
56	  This enables the XFRM (IPSec) networking security hooks.
57	  If enabled, a security module can use these hooks to
58	  implement per-packet access controls based on labels
59	  derived from IPSec policy.  Non-IPSec communications are
60	  designated as unlabelled, and only sockets authorized
61	  to communicate unlabelled data can send without using
62	  IPSec.
63	  If you are unsure how to answer this question, answer N.
64
65config SECURITY_PATH
66	bool "Security hooks for pathname based access control"
67	depends on SECURITY
68	help
69	  This enables the security hooks for pathname based access control.
70	  If enabled, a security module can use these hooks to
71	  implement pathname based access controls.
72	  If you are unsure how to answer this question, answer N.
73
74config INTEL_TXT
75	bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
76	depends on HAVE_INTEL_TXT
77	help
78	  This option enables support for booting the kernel with the
79	  Trusted Boot (tboot) module. This will utilize
80	  Intel(R) Trusted Execution Technology to perform a measured launch
81	  of the kernel. If the system does not support Intel(R) TXT, this
82	  will have no effect.
83
84	  Intel TXT will provide higher assurance of system configuration and
85	  initial state as well as data reset protection.  This is used to
86	  create a robust initial kernel measurement and verification, which
87	  helps to ensure that kernel security mechanisms are functioning
88	  correctly. This level of protection requires a root of trust outside
89	  of the kernel itself.
90
91	  Intel TXT also helps solve real end user concerns about having
92	  confidence that their hardware is running the VMM or kernel that
93	  it was configured with, especially since they may be responsible for
94	  providing such assurances to VMs and services running on it.
95
96	  See <http://www.intel.com/technology/security/> for more information
97	  about Intel(R) TXT.
98	  See <http://tboot.sourceforge.net> for more information about tboot.
99	  See Documentation/intel_txt.txt for a description of how to enable
100	  Intel TXT support in a kernel boot.
101
102	  If you are unsure as to whether this is required, answer N.
103
104config LSM_MMAP_MIN_ADDR
105	int "Low address space for LSM to protect from user allocation"
106	depends on SECURITY && SECURITY_SELINUX
107	default 32768 if ARM || (ARM64 && COMPAT)
108	default 65536
109	help
110	  This is the portion of low virtual memory which should be protected
111	  from userspace allocation.  Keeping a user from writing to low pages
112	  can help reduce the impact of kernel NULL pointer bugs.
113
114	  For most ia64, ppc64 and x86 users with lots of address space
115	  a value of 65536 is reasonable and should cause no problems.
116	  On arm and other archs it should not be higher than 32768.
117	  Programs which use vm86 functionality or have some need to map
118	  this low address space will need the permission specific to the
119	  systems running LSM.
120
121config HAVE_HARDENED_USERCOPY_ALLOCATOR
122	bool
123	help
124	  The heap allocator implements __check_heap_object() for
125	  validating memory ranges against heap object sizes in
126	  support of CONFIG_HARDENED_USERCOPY.
127
128config HAVE_ARCH_HARDENED_USERCOPY
129	bool
130	help
131	  The architecture supports CONFIG_HARDENED_USERCOPY by
132	  calling check_object_size() just before performing the
133	  userspace copies in the low level implementation of
134	  copy_to_user() and copy_from_user().
135
136config HARDENED_USERCOPY
137	bool "Harden memory copies between kernel and userspace"
138	depends on HAVE_ARCH_HARDENED_USERCOPY
139	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
140	select BUG
141	help
142	  This option checks for obviously wrong memory regions when
143	  copying memory to/from the kernel (via copy_to_user() and
144	  copy_from_user() functions) by rejecting memory ranges that
145	  are larger than the specified heap object, span multiple
146	  separately allocates pages, are not on the process stack,
147	  or are part of the kernel text. This kills entire classes
148	  of heap overflow exploits and similar kernel memory exposures.
149
150config HARDENED_USERCOPY_PAGESPAN
151	bool "Refuse to copy allocations that span multiple pages"
152	depends on HARDENED_USERCOPY
153	depends on EXPERT
154	help
155	  When a multi-page allocation is done without __GFP_COMP,
156	  hardened usercopy will reject attempts to copy it. There are,
157	  however, several cases of this in the kernel that have not all
158	  been removed. This config is intended to be used only while
159	  trying to find such users.
160
161source security/selinux/Kconfig
162source security/smack/Kconfig
163source security/tomoyo/Kconfig
164source security/apparmor/Kconfig
165source security/loadpin/Kconfig
166source security/yama/Kconfig
167
168source security/integrity/Kconfig
169
170choice
171	prompt "Default security module"
172	default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
173	default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
174	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
175	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
176	default DEFAULT_SECURITY_DAC
177
178	help
179	  Select the security module that will be used by default if the
180	  kernel parameter security= is not specified.
181
182	config DEFAULT_SECURITY_SELINUX
183		bool "SELinux" if SECURITY_SELINUX=y
184
185	config DEFAULT_SECURITY_SMACK
186		bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
187
188	config DEFAULT_SECURITY_TOMOYO
189		bool "TOMOYO" if SECURITY_TOMOYO=y
190
191	config DEFAULT_SECURITY_APPARMOR
192		bool "AppArmor" if SECURITY_APPARMOR=y
193
194	config DEFAULT_SECURITY_DAC
195		bool "Unix Discretionary Access Controls"
196
197endchoice
198
199config DEFAULT_SECURITY
200	string
201	default "selinux" if DEFAULT_SECURITY_SELINUX
202	default "smack" if DEFAULT_SECURITY_SMACK
203	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
204	default "apparmor" if DEFAULT_SECURITY_APPARMOR
205	default "" if DEFAULT_SECURITY_DAC
206
207endmenu
208
209