0001 # SPDX-License-Identifier: GPL-2.0-only
0002 config SECURITY_SAFESETID
0003 bool "Gate setid transitions to limit CAP_SET{U/G}ID capabilities"
0004 depends on SECURITY
0005 select SECURITYFS
0006 default n
0007 help
0008 SafeSetID is an LSM module that gates the setid family of syscalls to
0009 restrict UID/GID transitions from a given UID/GID to only those
0010 approved by a system-wide whitelist. These restrictions also prohibit
0011 the given UIDs/GIDs from obtaining auxiliary privileges associated
0012 with CAP_SET{U/G}ID, such as allowing a user to set up user namespace
0013 UID mappings.
0014
0015 If you are unsure how to answer this question, answer N.
