1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_APPARMOR 3 bool "AppArmor support" 4 depends on SECURITY && NET 5 select AUDIT 6 select SECURITY_PATH 7 select SECURITYFS 8 select SECURITY_NETWORK 9 select ZLIB_INFLATE 10 select ZLIB_DEFLATE 11 default n 12 help 13 This enables the AppArmor security module. 14 Required userspace tools (if they are not included in your 15 distribution) and further information may be found at 16 http://apparmor.wiki.kernel.org 17 18 If you are unsure how to answer this question, answer N. 19 20config SECURITY_APPARMOR_HASH 21 bool "Enable introspection of sha1 hashes for loaded profiles" 22 depends on SECURITY_APPARMOR 23 select CRYPTO 24 select CRYPTO_SHA1 25 default y 26 help 27 This option selects whether introspection of loaded policy 28 is available to userspace via the apparmor filesystem. 29 30config SECURITY_APPARMOR_HASH_DEFAULT 31 bool "Enable policy hash introspection by default" 32 depends on SECURITY_APPARMOR_HASH 33 default y 34 help 35 This option selects whether sha1 hashing of loaded policy 36 is enabled by default. The generation of sha1 hashes for 37 loaded policy provide system administrators a quick way 38 to verify that policy in the kernel matches what is expected, 39 however it can slow down policy load on some devices. In 40 these cases policy hashing can be disabled by default and 41 enabled only if needed. 42 43config SECURITY_APPARMOR_DEBUG 44 bool "Build AppArmor with debug code" 45 depends on SECURITY_APPARMOR 46 default n 47 help 48 Build apparmor with debugging logic in apparmor. Not all 49 debugging logic will necessarily be enabled. A submenu will 50 provide fine grained control of the debug options that are 51 available. 52 53config SECURITY_APPARMOR_DEBUG_ASSERTS 54 bool "Build AppArmor with debugging asserts" 55 depends on SECURITY_APPARMOR_DEBUG 56 default y 57 help 58 Enable code assertions made with AA_BUG. These are primarily 59 function entry preconditions but also exist at other key 60 points. If the assert is triggered it will trigger a WARN 61 message. 62 63config SECURITY_APPARMOR_DEBUG_MESSAGES 64 bool "Debug messages enabled by default" 65 depends on SECURITY_APPARMOR_DEBUG 66 default n 67 help 68 Set the default value of the apparmor.debug kernel parameter. 69 When enabled, various debug messages will be logged to 70 the kernel message buffer. 71 72config SECURITY_APPARMOR_KUNIT_TEST 73 bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS 74 depends on KUNIT=y && SECURITY_APPARMOR 75 default KUNIT_ALL_TESTS 76 help 77 This builds the AppArmor KUnit tests. 78 79 KUnit tests run during boot and output the results to the debug log 80 in TAP format (https://testanything.org/). Only useful for kernel devs 81 running KUnit test harness and are not for inclusion into a 82 production build. 83 84 For more information on KUnit and unit tests in general please refer 85 to the KUnit documentation in Documentation/dev-tools/kunit/. 86 87 If unsure, say N. 88