1config SECURITY_SAFESETID 2 bool "Gate setid transitions to limit CAP_SET{U/G}ID capabilities" 3 depends on SECURITY 4 select SECURITYFS 5 default n 6 help 7 SafeSetID is an LSM module that gates the setid family of syscalls to 8 restrict UID/GID transitions from a given UID/GID to only those 9 approved by a system-wide whitelist. These restrictions also prohibit 10 the given UIDs/GIDs from obtaining auxiliary privileges associated 11 with CAP_SET{U/G}ID, such as allowing a user to set up user namespace 12 UID mappings. 13 14 If you are unsure how to answer this question, answer N. 15