0001 # SPDX-License-Identifier: GPL-2.0-only
0002 config SECURITY_SMACK
0003 bool "Simplified Mandatory Access Control Kernel Support"
0004 depends on NET
0005 depends on INET
0006 depends on SECURITY
0007 select NETLABEL
0008 select SECURITY_NETWORK
0009 default n
0010 help
0011 This selects the Simplified Mandatory Access Control Kernel.
0012 Smack is useful for sensitivity, integrity, and a variety
0013 of other mandatory security schemes.
0014 If you are unsure how to answer this question, answer N.
0015
0016 config SECURITY_SMACK_BRINGUP
0017 bool "Reporting on access granted by Smack rules"
0018 depends on SECURITY_SMACK
0019 default n
0020 help
0021 Enable the bring-up ("b") access mode in Smack rules.
0022 When access is granted by a rule with the "b" mode a
0023 message about the access requested is generated. The
0024 intention is that a process can be granted a wide set
0025 of access initially with the bringup mode set on the
0026 rules. The developer can use the information to
0027 identify which rules are necessary and what accesses
0028 may be inappropriate. The developer can reduce the
0029 access rule set once the behavior is well understood.
0030 This is a superior mechanism to the oft abused
0031 "permissive" mode of other systems.
0032 If you are unsure how to answer this question, answer N.
0033
0034 config SECURITY_SMACK_NETFILTER
0035 bool "Packet marking using secmarks for netfilter"
0036 depends on SECURITY_SMACK
0037 depends on NETWORK_SECMARK
0038 depends on NETFILTER
0039 default n
0040 help
0041 This enables security marking of network packets using
0042 Smack labels.
0043 If you are unsure how to answer this question, answer N.
0044
0045 config SECURITY_SMACK_APPEND_SIGNALS
0046 bool "Treat delivering signals as an append operation"
0047 depends on SECURITY_SMACK
0048 default n
0049 help
0050 Sending a signal has been treated as a write operation to the
0051 receiving process. If this option is selected, the delivery
0052 will be an append operation instead. This makes it possible
0053 to differentiate between delivering a network packet and
0054 delivering a signal in the Smack rules.
0055 If you are unsure how to answer this question, answer N.
