0001 # SPDX-License-Identifier: GPL-2.0-only
0002 config SECURITY_SELINUX
0003 bool "NSA SELinux Support"
0004 depends on SECURITY_NETWORK && AUDIT && NET && INET
0005 select NETWORK_SECMARK
0006 default n
0007 help
0008 This selects NSA Security-Enhanced Linux (SELinux).
0009 You will also need a policy configuration and a labeled filesystem.
0010 If you are unsure how to answer this question, answer N.
0011
0012 config SECURITY_SELINUX_BOOTPARAM
0013 bool "NSA SELinux boot parameter"
0014 depends on SECURITY_SELINUX
0015 default n
0016 help
0017 This option adds a kernel parameter 'selinux', which allows SELinux
0018 to be disabled at boot. If this option is selected, SELinux
0019 functionality can be disabled with selinux=0 on the kernel
0020 command line. The purpose of this option is to allow a single
0021 kernel image to be distributed with SELinux built in, but not
0022 necessarily enabled.
0023
0024 If you are unsure how to answer this question, answer N.
0025
0026 config SECURITY_SELINUX_DISABLE
0027 bool "NSA SELinux runtime disable"
0028 depends on SECURITY_SELINUX
0029 select SECURITY_WRITABLE_HOOKS
0030 default n
0031 help
0032 This option enables writing to a selinuxfs node 'disable', which
0033 allows SELinux to be disabled at runtime prior to the policy load.
0034 SELinux will then remain disabled until the next boot.
0035 This option is similar to the selinux=0 boot parameter, but is to
0036 support runtime disabling of SELinux, e.g. from /sbin/init, for
0037 portability across platforms where boot parameters are difficult
0038 to employ.
0039
0040 NOTE: selecting this option will disable the '__ro_after_init'
0041 kernel hardening feature for security hooks. Please consider
0042 using the selinux=0 boot parameter instead of enabling this
0043 option.
0044
0045 WARNING: this option is deprecated and will be removed in a future
0046 kernel release.
0047
0048 If you are unsure how to answer this question, answer N.
0049
0050 config SECURITY_SELINUX_DEVELOP
0051 bool "NSA SELinux Development Support"
0052 depends on SECURITY_SELINUX
0053 default y
0054 help
0055 This enables the development support option of NSA SELinux,
0056 which is useful for experimenting with SELinux and developing
0057 policies. If unsure, say Y. With this option enabled, the
0058 kernel will start in permissive mode (log everything, deny nothing)
0059 unless you specify enforcing=1 on the kernel command line. You
0060 can interactively toggle the kernel between enforcing mode and
0061 permissive mode (if permitted by the policy) via
0062 /sys/fs/selinux/enforce.
0063
0064 config SECURITY_SELINUX_AVC_STATS
0065 bool "NSA SELinux AVC Statistics"
0066 depends on SECURITY_SELINUX
0067 default y
0068 help
0069 This option collects access vector cache statistics to
0070 /sys/fs/selinux/avc/cache_stats, which may be monitored via
0071 tools such as avcstat.
0072
0073 config SECURITY_SELINUX_CHECKREQPROT_VALUE
0074 int "NSA SELinux checkreqprot default value"
0075 depends on SECURITY_SELINUX
0076 range 0 1
0077 default 0
0078 help
0079 This option sets the default value for the 'checkreqprot' flag
0080 that determines whether SELinux checks the protection requested
0081 by the application or the protection that will be applied by the
0082 kernel (including any implied execute for read-implies-exec) for
0083 mmap and mprotect calls. If this option is set to 0 (zero),
0084 SELinux will default to checking the protection that will be applied
0085 by the kernel. If this option is set to 1 (one), SELinux will
0086 default to checking the protection requested by the application.
0087 The checkreqprot flag may be changed from the default via the
0088 'checkreqprot=' boot parameter. It may also be changed at runtime
0089 via /sys/fs/selinux/checkreqprot if authorized by policy.
0090
0091 WARNING: this option is deprecated and will be removed in a future
0092 kernel release.
0093
0094 If you are unsure how to answer this question, answer 0.
0095
0096 config SECURITY_SELINUX_SIDTAB_HASH_BITS
0097 int "NSA SELinux sidtab hashtable size"
0098 depends on SECURITY_SELINUX
0099 range 8 13
0100 default 9
0101 help
0102 This option sets the number of buckets used in the sidtab hashtable
0103 to 2^SECURITY_SELINUX_SIDTAB_HASH_BITS buckets. The number of hash
0104 collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If
0105 chain lengths are high (e.g. > 20) then selecting a higher value here
0106 will ensure that lookups times are short and stable.
0107
0108 config SECURITY_SELINUX_SID2STR_CACHE_SIZE
0109 int "NSA SELinux SID to context string translation cache size"
0110 depends on SECURITY_SELINUX
0111 default 256
0112 help
0113 This option defines the size of the internal SID -> context string
0114 cache, which improves the performance of context to string
0115 conversion. Setting this option to 0 disables the cache completely.
0116
0117 If unsure, keep the default value.
