0001 # SPDX-License-Identifier: GPL-2.0-only
0002 #
0003 # Security configuration
0004 #
0005
0006 menu "Security options"
0007
0008 source "security/keys/Kconfig"
0009
0010 config SECURITY_DMESG_RESTRICT
0011 bool "Restrict unprivileged access to the kernel syslog"
0012 default n
0013 help
0014 This enforces restrictions on unprivileged users reading the kernel
0015 syslog via dmesg(8).
0016
0017 If this option is not selected, no restrictions will be enforced
0018 unless the dmesg_restrict sysctl is explicitly set to (1).
0019
0020 If you are unsure how to answer this question, answer N.
0021
0022 config SECURITY
0023 bool "Enable different security models"
0024 depends on SYSFS
0025 depends on MULTIUSER
0026 help
0027 This allows you to choose different security modules to be
0028 configured into your kernel.
0029
0030 If this option is not selected, the default Linux security
0031 model will be used.
0032
0033 If you are unsure how to answer this question, answer N.
0034
0035 config SECURITY_WRITABLE_HOOKS
0036 depends on SECURITY
0037 bool
0038 default n
0039
0040 config SECURITYFS
0041 bool "Enable the securityfs filesystem"
0042 help
0043 This will build the securityfs filesystem. It is currently used by
0044 various security modules (AppArmor, IMA, SafeSetID, TOMOYO, TPM).
0045
0046 If you are unsure how to answer this question, answer N.
0047
0048 config SECURITY_NETWORK
0049 bool "Socket and Networking Security Hooks"
0050 depends on SECURITY
0051 help
0052 This enables the socket and networking security hooks.
0053 If enabled, a security module can use these hooks to
0054 implement socket and networking access controls.
0055 If you are unsure how to answer this question, answer N.
0056
0057 config SECURITY_INFINIBAND
0058 bool "Infiniband Security Hooks"
0059 depends on SECURITY && INFINIBAND
0060 help
0061 This enables the Infiniband security hooks.
0062 If enabled, a security module can use these hooks to
0063 implement Infiniband access controls.
0064 If you are unsure how to answer this question, answer N.
0065
0066 config SECURITY_NETWORK_XFRM
0067 bool "XFRM (IPSec) Networking Security Hooks"
0068 depends on XFRM && SECURITY_NETWORK
0069 help
0070 This enables the XFRM (IPSec) networking security hooks.
0071 If enabled, a security module can use these hooks to
0072 implement per-packet access controls based on labels
0073 derived from IPSec policy. Non-IPSec communications are
0074 designated as unlabelled, and only sockets authorized
0075 to communicate unlabelled data can send without using
0076 IPSec.
0077 If you are unsure how to answer this question, answer N.
0078
0079 config SECURITY_PATH
0080 bool "Security hooks for pathname based access control"
0081 depends on SECURITY
0082 help
0083 This enables the security hooks for pathname based access control.
0084 If enabled, a security module can use these hooks to
0085 implement pathname based access controls.
0086 If you are unsure how to answer this question, answer N.
0087
0088 config INTEL_TXT
0089 bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
0090 depends on HAVE_INTEL_TXT
0091 help
0092 This option enables support for booting the kernel with the
0093 Trusted Boot (tboot) module. This will utilize
0094 Intel(R) Trusted Execution Technology to perform a measured launch
0095 of the kernel. If the system does not support Intel(R) TXT, this
0096 will have no effect.
0097
0098 Intel TXT will provide higher assurance of system configuration and
0099 initial state as well as data reset protection. This is used to
0100 create a robust initial kernel measurement and verification, which
0101 helps to ensure that kernel security mechanisms are functioning
0102 correctly. This level of protection requires a root of trust outside
0103 of the kernel itself.
0104
0105 Intel TXT also helps solve real end user concerns about having
0106 confidence that their hardware is running the VMM or kernel that
0107 it was configured with, especially since they may be responsible for
0108 providing such assurances to VMs and services running on it.
0109
0110 See <https://www.intel.com/technology/security/> for more information
0111 about Intel(R) TXT.
0112 See <http://tboot.sourceforge.net> for more information about tboot.
0113 See Documentation/x86/intel_txt.rst for a description of how to enable
0114 Intel TXT support in a kernel boot.
0115
0116 If you are unsure as to whether this is required, answer N.
0117
0118 config LSM_MMAP_MIN_ADDR
0119 int "Low address space for LSM to protect from user allocation"
0120 depends on SECURITY && SECURITY_SELINUX
0121 default 32768 if ARM || (ARM64 && COMPAT)
0122 default 65536
0123 help
0124 This is the portion of low virtual memory which should be protected
0125 from userspace allocation. Keeping a user from writing to low pages
0126 can help reduce the impact of kernel NULL pointer bugs.
0127
0128 For most ia64, ppc64 and x86 users with lots of address space
0129 a value of 65536 is reasonable and should cause no problems.
0130 On arm and other archs it should not be higher than 32768.
0131 Programs which use vm86 functionality or have some need to map
0132 this low address space will need the permission specific to the
0133 systems running LSM.
0134
0135 config HAVE_HARDENED_USERCOPY_ALLOCATOR
0136 bool
0137 help
0138 The heap allocator implements __check_heap_object() for
0139 validating memory ranges against heap object sizes in
0140 support of CONFIG_HARDENED_USERCOPY.
0141
0142 config HARDENED_USERCOPY
0143 bool "Harden memory copies between kernel and userspace"
0144 depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
0145 imply STRICT_DEVMEM
0146 help
0147 This option checks for obviously wrong memory regions when
0148 copying memory to/from the kernel (via copy_to_user() and
0149 copy_from_user() functions) by rejecting memory ranges that
0150 are larger than the specified heap object, span multiple
0151 separately allocated pages, are not on the process stack,
0152 or are part of the kernel text. This prevents entire classes
0153 of heap overflow exploits and similar kernel memory exposures.
0154
0155 config FORTIFY_SOURCE
0156 bool "Harden common str/mem functions against buffer overflows"
0157 depends on ARCH_HAS_FORTIFY_SOURCE
0158 # https://bugs.llvm.org/show_bug.cgi?id=41459
0159 depends on !CC_IS_CLANG || CLANG_VERSION >= 120001
0160 # https://github.com/llvm/llvm-project/issues/53645
0161 depends on !CC_IS_CLANG || !X86_32
0162 help
0163 Detect overflows of buffers in common string and memory functions
0164 where the compiler can determine and validate the buffer sizes.
0165
0166 config STATIC_USERMODEHELPER
0167 bool "Force all usermode helper calls through a single binary"
0168 help
0169 By default, the kernel can call many different userspace
0170 binary programs through the "usermode helper" kernel
0171 interface. Some of these binaries are statically defined
0172 either in the kernel code itself, or as a kernel configuration
0173 option. However, some of these are dynamically created at
0174 runtime, or can be modified after the kernel has started up.
0175 To provide an additional layer of security, route all of these
0176 calls through a single executable that can not have its name
0177 changed.
0178
0179 Note, it is up to this single binary to then call the relevant
0180 "real" usermode helper binary, based on the first argument
0181 passed to it. If desired, this program can filter and pick
0182 and choose what real programs are called.
0183
0184 If you wish for all usermode helper programs are to be
0185 disabled, choose this option and then set
0186 STATIC_USERMODEHELPER_PATH to an empty string.
0187
0188 config STATIC_USERMODEHELPER_PATH
0189 string "Path to the static usermode helper binary"
0190 depends on STATIC_USERMODEHELPER
0191 default "/sbin/usermode-helper"
0192 help
0193 The binary called by the kernel when any usermode helper
0194 program is wish to be run. The "real" application's name will
0195 be in the first argument passed to this program on the command
0196 line.
0197
0198 If you wish for all usermode helper programs to be disabled,
0199 specify an empty string here (i.e. "").
0200
0201 source "security/selinux/Kconfig"
0202 source "security/smack/Kconfig"
0203 source "security/tomoyo/Kconfig"
0204 source "security/apparmor/Kconfig"
0205 source "security/loadpin/Kconfig"
0206 source "security/yama/Kconfig"
0207 source "security/safesetid/Kconfig"
0208 source "security/lockdown/Kconfig"
0209 source "security/landlock/Kconfig"
0210
0211 source "security/integrity/Kconfig"
0212
0213 choice
0214 prompt "First legacy 'major LSM' to be initialized"
0215 default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
0216 default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
0217 default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
0218 default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
0219 default DEFAULT_SECURITY_DAC
0220
0221 help
0222 This choice is there only for converting CONFIG_DEFAULT_SECURITY
0223 in old kernel configs to CONFIG_LSM in new kernel configs. Don't
0224 change this choice unless you are creating a fresh kernel config,
0225 for this choice will be ignored after CONFIG_LSM has been set.
0226
0227 Selects the legacy "major security module" that will be
0228 initialized first. Overridden by non-default CONFIG_LSM.
0229
0230 config DEFAULT_SECURITY_SELINUX
0231 bool "SELinux" if SECURITY_SELINUX=y
0232
0233 config DEFAULT_SECURITY_SMACK
0234 bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
0235
0236 config DEFAULT_SECURITY_TOMOYO
0237 bool "TOMOYO" if SECURITY_TOMOYO=y
0238
0239 config DEFAULT_SECURITY_APPARMOR
0240 bool "AppArmor" if SECURITY_APPARMOR=y
0241
0242 config DEFAULT_SECURITY_DAC
0243 bool "Unix Discretionary Access Controls"
0244
0245 endchoice
0246
0247 config LSM
0248 string "Ordered list of enabled LSMs"
0249 default "landlock,lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
0250 default "landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
0251 default "landlock,lockdown,yama,loadpin,safesetid,integrity,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
0252 default "landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" if DEFAULT_SECURITY_DAC
0253 default "landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
0254 help
0255 A comma-separated list of LSMs, in initialization order.
0256 Any LSMs left off this list will be ignored. This can be
0257 controlled at boot with the "lsm=" parameter.
0258
0259 If unsure, leave this as the default.
0260
0261 source "security/Kconfig.hardening"
0262
0263 endmenu
0264
