0001 # SPDX-License-Identifier: GPL-2.0-only
0002 config SECURITY_APPARMOR
0003 bool "AppArmor support"
0004 depends on SECURITY && NET
0005 select AUDIT
0006 select SECURITY_PATH
0007 select SECURITYFS
0008 select SECURITY_NETWORK
0009 default n
0010 help
0011 This enables the AppArmor security module.
0012 Required userspace tools (if they are not included in your
0013 distribution) and further information may be found at
0014 http://apparmor.wiki.kernel.org
0015
0016 If you are unsure how to answer this question, answer N.
0017
0018 config SECURITY_APPARMOR_DEBUG
0019 bool "Build AppArmor with debug code"
0020 depends on SECURITY_APPARMOR
0021 default n
0022 help
0023 Build apparmor with debugging logic in apparmor. Not all
0024 debugging logic will necessarily be enabled. A submenu will
0025 provide fine grained control of the debug options that are
0026 available.
0027
0028 config SECURITY_APPARMOR_DEBUG_ASSERTS
0029 bool "Build AppArmor with debugging asserts"
0030 depends on SECURITY_APPARMOR_DEBUG
0031 default y
0032 help
0033 Enable code assertions made with AA_BUG. These are primarily
0034 function entry preconditions but also exist at other key
0035 points. If the assert is triggered it will trigger a WARN
0036 message.
0037
0038 config SECURITY_APPARMOR_DEBUG_MESSAGES
0039 bool "Debug messages enabled by default"
0040 depends on SECURITY_APPARMOR_DEBUG
0041 default n
0042 help
0043 Set the default value of the apparmor.debug kernel parameter.
0044 When enabled, various debug messages will be logged to
0045 the kernel message buffer.
0046
0047 config SECURITY_APPARMOR_INTROSPECT_POLICY
0048 bool "Allow loaded policy to be introspected"
0049 depends on SECURITY_APPARMOR
0050 default y
0051 help
0052 This option selects whether introspection of loaded policy
0053 is available to userspace via the apparmor filesystem. This
0054 adds to kernel memory usage. It is required for introspection
0055 of loaded policy, and check point and restore support. It
0056 can be disabled for embedded systems where reducing memory and
0057 cpu is paramount.
0058
0059 config SECURITY_APPARMOR_HASH
0060 bool "Enable introspection of sha1 hashes for loaded profiles"
0061 depends on SECURITY_APPARMOR_INTROSPECT_POLICY
0062 select CRYPTO
0063 select CRYPTO_SHA1
0064 default y
0065 help
0066 This option selects whether introspection of loaded policy
0067 hashes is available to userspace via the apparmor
0068 filesystem. This option provides a light weight means of
0069 checking loaded policy. This option adds to policy load
0070 time and can be disabled for small embedded systems.
0071
0072 config SECURITY_APPARMOR_HASH_DEFAULT
0073 bool "Enable policy hash introspection by default"
0074 depends on SECURITY_APPARMOR_HASH
0075 default y
0076 help
0077 This option selects whether sha1 hashing of loaded policy
0078 is enabled by default. The generation of sha1 hashes for
0079 loaded policy provide system administrators a quick way
0080 to verify that policy in the kernel matches what is expected,
0081 however it can slow down policy load on some devices. In
0082 these cases policy hashing can be disabled by default and
0083 enabled only if needed.
0084
0085 config SECURITY_APPARMOR_EXPORT_BINARY
0086 bool "Allow exporting the raw binary policy"
0087 depends on SECURITY_APPARMOR_INTROSPECT_POLICY
0088 select ZLIB_INFLATE
0089 select ZLIB_DEFLATE
0090 default y
0091 help
0092 This option allows reading back binary policy as it was loaded.
0093 It increases the amount of kernel memory needed by policy and
0094 also increases policy load time. This option is required for
0095 checkpoint and restore support, and debugging of loaded policy.
0096
0097 config SECURITY_APPARMOR_PARANOID_LOAD
0098 bool "Perform full verification of loaded policy"
0099 depends on SECURITY_APPARMOR
0100 default y
0101 help
0102 This options allows controlling whether apparmor does a full
0103 verification of loaded policy. This should not be disabled
0104 except for embedded systems where the image is read only,
0105 includes policy, and has some form of integrity check.
0106 Disabling the check will speed up policy loads.
0107
0108 config SECURITY_APPARMOR_KUNIT_TEST
0109 bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
0110 depends on KUNIT=y && SECURITY_APPARMOR
0111 default KUNIT_ALL_TESTS
0112 help
0113 This builds the AppArmor KUnit tests.
0114
0115 KUnit tests run during boot and output the results to the debug log
0116 in TAP format (https://testanything.org/). Only useful for kernel devs
0117 running KUnit test harness and are not for inclusion into a
0118 production build.
0119
0120 For more information on KUnit and unit tests in general please refer
0121 to the KUnit documentation in Documentation/dev-tools/kunit/.
0122
0123 If unsure, say N.
