xref: /openbmc/linux/security/Kconfig (revision e58e871b)
1#
2# Security configuration
3#
4
5menu "Security options"
6
7source security/keys/Kconfig
8
9config SECURITY_DMESG_RESTRICT
10	bool "Restrict unprivileged access to the kernel syslog"
11	default n
12	help
13	  This enforces restrictions on unprivileged users reading the kernel
14	  syslog via dmesg(8).
15
16	  If this option is not selected, no restrictions will be enforced
17	  unless the dmesg_restrict sysctl is explicitly set to (1).
18
19	  If you are unsure how to answer this question, answer N.
20
21config SECURITY
22	bool "Enable different security models"
23	depends on SYSFS
24	depends on MULTIUSER
25	help
26	  This allows you to choose different security modules to be
27	  configured into your kernel.
28
29	  If this option is not selected, the default Linux security
30	  model will be used.
31
32	  If you are unsure how to answer this question, answer N.
33
34config SECURITY_WRITABLE_HOOKS
35	depends on SECURITY
36	bool
37	default n
38
39config SECURITYFS
40	bool "Enable the securityfs filesystem"
41	help
42	  This will build the securityfs filesystem.  It is currently used by
43	  the TPM bios character driver and IMA, an integrity provider.  It is
44	  not used by SELinux or SMACK.
45
46	  If you are unsure how to answer this question, answer N.
47
48config SECURITY_NETWORK
49	bool "Socket and Networking Security Hooks"
50	depends on SECURITY
51	help
52	  This enables the socket and networking security hooks.
53	  If enabled, a security module can use these hooks to
54	  implement socket and networking access controls.
55	  If you are unsure how to answer this question, answer N.
56
57config SECURITY_NETWORK_XFRM
58	bool "XFRM (IPSec) Networking Security Hooks"
59	depends on XFRM && SECURITY_NETWORK
60	help
61	  This enables the XFRM (IPSec) networking security hooks.
62	  If enabled, a security module can use these hooks to
63	  implement per-packet access controls based on labels
64	  derived from IPSec policy.  Non-IPSec communications are
65	  designated as unlabelled, and only sockets authorized
66	  to communicate unlabelled data can send without using
67	  IPSec.
68	  If you are unsure how to answer this question, answer N.
69
70config SECURITY_PATH
71	bool "Security hooks for pathname based access control"
72	depends on SECURITY
73	help
74	  This enables the security hooks for pathname based access control.
75	  If enabled, a security module can use these hooks to
76	  implement pathname based access controls.
77	  If you are unsure how to answer this question, answer N.
78
79config INTEL_TXT
80	bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
81	depends on HAVE_INTEL_TXT
82	help
83	  This option enables support for booting the kernel with the
84	  Trusted Boot (tboot) module. This will utilize
85	  Intel(R) Trusted Execution Technology to perform a measured launch
86	  of the kernel. If the system does not support Intel(R) TXT, this
87	  will have no effect.
88
89	  Intel TXT will provide higher assurance of system configuration and
90	  initial state as well as data reset protection.  This is used to
91	  create a robust initial kernel measurement and verification, which
92	  helps to ensure that kernel security mechanisms are functioning
93	  correctly. This level of protection requires a root of trust outside
94	  of the kernel itself.
95
96	  Intel TXT also helps solve real end user concerns about having
97	  confidence that their hardware is running the VMM or kernel that
98	  it was configured with, especially since they may be responsible for
99	  providing such assurances to VMs and services running on it.
100
101	  See <http://www.intel.com/technology/security/> for more information
102	  about Intel(R) TXT.
103	  See <http://tboot.sourceforge.net> for more information about tboot.
104	  See Documentation/intel_txt.txt for a description of how to enable
105	  Intel TXT support in a kernel boot.
106
107	  If you are unsure as to whether this is required, answer N.
108
109config LSM_MMAP_MIN_ADDR
110	int "Low address space for LSM to protect from user allocation"
111	depends on SECURITY && SECURITY_SELINUX
112	default 32768 if ARM || (ARM64 && COMPAT)
113	default 65536
114	help
115	  This is the portion of low virtual memory which should be protected
116	  from userspace allocation.  Keeping a user from writing to low pages
117	  can help reduce the impact of kernel NULL pointer bugs.
118
119	  For most ia64, ppc64 and x86 users with lots of address space
120	  a value of 65536 is reasonable and should cause no problems.
121	  On arm and other archs it should not be higher than 32768.
122	  Programs which use vm86 functionality or have some need to map
123	  this low address space will need the permission specific to the
124	  systems running LSM.
125
126config HAVE_HARDENED_USERCOPY_ALLOCATOR
127	bool
128	help
129	  The heap allocator implements __check_heap_object() for
130	  validating memory ranges against heap object sizes in
131	  support of CONFIG_HARDENED_USERCOPY.
132
133config HARDENED_USERCOPY
134	bool "Harden memory copies between kernel and userspace"
135	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
136	select BUG
137	help
138	  This option checks for obviously wrong memory regions when
139	  copying memory to/from the kernel (via copy_to_user() and
140	  copy_from_user() functions) by rejecting memory ranges that
141	  are larger than the specified heap object, span multiple
142	  separately allocates pages, are not on the process stack,
143	  or are part of the kernel text. This kills entire classes
144	  of heap overflow exploits and similar kernel memory exposures.
145
146config HARDENED_USERCOPY_PAGESPAN
147	bool "Refuse to copy allocations that span multiple pages"
148	depends on HARDENED_USERCOPY
149	depends on EXPERT
150	help
151	  When a multi-page allocation is done without __GFP_COMP,
152	  hardened usercopy will reject attempts to copy it. There are,
153	  however, several cases of this in the kernel that have not all
154	  been removed. This config is intended to be used only while
155	  trying to find such users.
156
157config STATIC_USERMODEHELPER
158	bool "Force all usermode helper calls through a single binary"
159	help
160	  By default, the kernel can call many different userspace
161	  binary programs through the "usermode helper" kernel
162	  interface.  Some of these binaries are statically defined
163	  either in the kernel code itself, or as a kernel configuration
164	  option.  However, some of these are dynamically created at
165	  runtime, or can be modified after the kernel has started up.
166	  To provide an additional layer of security, route all of these
167	  calls through a single executable that can not have its name
168	  changed.
169
170	  Note, it is up to this single binary to then call the relevant
171	  "real" usermode helper binary, based on the first argument
172	  passed to it.  If desired, this program can filter and pick
173	  and choose what real programs are called.
174
175	  If you wish for all usermode helper programs are to be
176	  disabled, choose this option and then set
177	  STATIC_USERMODEHELPER_PATH to an empty string.
178
179config STATIC_USERMODEHELPER_PATH
180	string "Path to the static usermode helper binary"
181	depends on STATIC_USERMODEHELPER
182	default "/sbin/usermode-helper"
183	help
184	  The binary called by the kernel when any usermode helper
185	  program is wish to be run.  The "real" application's name will
186	  be in the first argument passed to this program on the command
187	  line.
188
189	  If you wish for all usermode helper programs to be disabled,
190	  specify an empty string here (i.e. "").
191
192source security/selinux/Kconfig
193source security/smack/Kconfig
194source security/tomoyo/Kconfig
195source security/apparmor/Kconfig
196source security/loadpin/Kconfig
197source security/yama/Kconfig
198
199source security/integrity/Kconfig
200
201choice
202	prompt "Default security module"
203	default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
204	default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
205	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
206	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
207	default DEFAULT_SECURITY_DAC
208
209	help
210	  Select the security module that will be used by default if the
211	  kernel parameter security= is not specified.
212
213	config DEFAULT_SECURITY_SELINUX
214		bool "SELinux" if SECURITY_SELINUX=y
215
216	config DEFAULT_SECURITY_SMACK
217		bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
218
219	config DEFAULT_SECURITY_TOMOYO
220		bool "TOMOYO" if SECURITY_TOMOYO=y
221
222	config DEFAULT_SECURITY_APPARMOR
223		bool "AppArmor" if SECURITY_APPARMOR=y
224
225	config DEFAULT_SECURITY_DAC
226		bool "Unix Discretionary Access Controls"
227
228endchoice
229
230config DEFAULT_SECURITY
231	string
232	default "selinux" if DEFAULT_SECURITY_SELINUX
233	default "smack" if DEFAULT_SECURITY_SMACK
234	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
235	default "apparmor" if DEFAULT_SECURITY_APPARMOR
236	default "" if DEFAULT_SECURITY_DAC
237
238endmenu
239
240