Kconfig 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. #
  3. # Security configuration
  4. #
  5. menu "Security options"
  6. source "security/keys/Kconfig"
  7. config SECURITY_DMESG_RESTRICT
  8. bool "Restrict unprivileged access to the kernel syslog"
  9. default n
  10. help
  11. This enforces restrictions on unprivileged users reading the kernel
  12. syslog via dmesg(8).
  13. If this option is not selected, no restrictions will be enforced
  14. unless the dmesg_restrict sysctl is explicitly set to (1).
  15. If you are unsure how to answer this question, answer N.
  16. config SECURITY
  17. bool "Enable different security models"
  18. depends on SYSFS
  19. depends on MULTIUSER
  20. help
  21. This allows you to choose different security modules to be
  22. configured into your kernel.
  23. If this option is not selected, the default Linux security
  24. model will be used.
  25. If you are unsure how to answer this question, answer N.
  26. config SECURITY_WRITABLE_HOOKS
  27. depends on SECURITY
  28. bool
  29. default n
  30. config SECURITYFS
  31. bool "Enable the securityfs filesystem"
  32. help
  33. This will build the securityfs filesystem. It is currently used by
  34. various security modules (AppArmor, IMA, SafeSetID, TOMOYO, TPM).
  35. If you are unsure how to answer this question, answer N.
  36. config SECURITY_NETWORK
  37. bool "Socket and Networking Security Hooks"
  38. depends on SECURITY
  39. help
  40. This enables the socket and networking security hooks.
  41. If enabled, a security module can use these hooks to
  42. implement socket and networking access controls.
  43. If you are unsure how to answer this question, answer N.
  44. config PAGE_TABLE_ISOLATION
  45. bool "Remove the kernel mapping in user mode"
  46. default y
  47. depends on (X86_64 || X86_PAE) && !UML
  48. help
  49. This feature reduces the number of hardware side channels by
  50. ensuring that the majority of kernel addresses are not mapped
  51. into userspace.
  52. See Documentation/x86/pti.rst for more details.
  53. config SECURITY_INFINIBAND
  54. bool "Infiniband Security Hooks"
  55. depends on SECURITY && INFINIBAND
  56. help
  57. This enables the Infiniband security hooks.
  58. If enabled, a security module can use these hooks to
  59. implement Infiniband access controls.
  60. If you are unsure how to answer this question, answer N.
  61. config SECURITY_NETWORK_XFRM
  62. bool "XFRM (IPSec) Networking Security Hooks"
  63. depends on XFRM && SECURITY_NETWORK
  64. help
  65. This enables the XFRM (IPSec) networking security hooks.
  66. If enabled, a security module can use these hooks to
  67. implement per-packet access controls based on labels
  68. derived from IPSec policy. Non-IPSec communications are
  69. designated as unlabelled, and only sockets authorized
  70. to communicate unlabelled data can send without using
  71. IPSec.
  72. If you are unsure how to answer this question, answer N.
  73. config SECURITY_PATH
  74. bool "Security hooks for pathname based access control"
  75. depends on SECURITY
  76. help
  77. This enables the security hooks for pathname based access control.
  78. If enabled, a security module can use these hooks to
  79. implement pathname based access controls.
  80. If you are unsure how to answer this question, answer N.
  81. config INTEL_TXT
  82. bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
  83. depends on HAVE_INTEL_TXT
  84. help
  85. This option enables support for booting the kernel with the
  86. Trusted Boot (tboot) module. This will utilize
  87. Intel(R) Trusted Execution Technology to perform a measured launch
  88. of the kernel. If the system does not support Intel(R) TXT, this
  89. will have no effect.
  90. Intel TXT will provide higher assurance of system configuration and
  91. initial state as well as data reset protection. This is used to
  92. create a robust initial kernel measurement and verification, which
  93. helps to ensure that kernel security mechanisms are functioning
  94. correctly. This level of protection requires a root of trust outside
  95. of the kernel itself.
  96. Intel TXT also helps solve real end user concerns about having
  97. confidence that their hardware is running the VMM or kernel that
  98. it was configured with, especially since they may be responsible for
  99. providing such assurances to VMs and services running on it.
  100. See <https://www.intel.com/technology/security/> for more information
  101. about Intel(R) TXT.
  102. See <http://tboot.sourceforge.net> for more information about tboot.
  103. See Documentation/x86/intel_txt.rst for a description of how to enable
  104. Intel TXT support in a kernel boot.
  105. If you are unsure as to whether this is required, answer N.
  106. config LSM_MMAP_MIN_ADDR
  107. int "Low address space for LSM to protect from user allocation"
  108. depends on SECURITY && SECURITY_SELINUX
  109. default 32768 if ARM || (ARM64 && COMPAT)
  110. default 65536
  111. help
  112. This is the portion of low virtual memory which should be protected
  113. from userspace allocation. Keeping a user from writing to low pages
  114. can help reduce the impact of kernel NULL pointer bugs.
  115. For most ia64, ppc64 and x86 users with lots of address space
  116. a value of 65536 is reasonable and should cause no problems.
  117. On arm and other archs it should not be higher than 32768.
  118. Programs which use vm86 functionality or have some need to map
  119. this low address space will need the permission specific to the
  120. systems running LSM.
  121. config HAVE_HARDENED_USERCOPY_ALLOCATOR
  122. bool
  123. help
  124. The heap allocator implements __check_heap_object() for
  125. validating memory ranges against heap object sizes in
  126. support of CONFIG_HARDENED_USERCOPY.
  127. config HARDENED_USERCOPY
  128. bool "Harden memory copies between kernel and userspace"
  129. depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
  130. imply STRICT_DEVMEM
  131. help
  132. This option checks for obviously wrong memory regions when
  133. copying memory to/from the kernel (via copy_to_user() and
  134. copy_from_user() functions) by rejecting memory ranges that
  135. are larger than the specified heap object, span multiple
  136. separately allocated pages, are not on the process stack,
  137. or are part of the kernel text. This kills entire classes
  138. of heap overflow exploits and similar kernel memory exposures.
  139. config HARDENED_USERCOPY_FALLBACK
  140. bool "Allow usercopy whitelist violations to fallback to object size"
  141. depends on HARDENED_USERCOPY
  142. default y
  143. help
  144. This is a temporary option that allows missing usercopy whitelists
  145. to be discovered via a WARN() to the kernel log, instead of
  146. rejecting the copy, falling back to non-whitelisted hardened
  147. usercopy that checks the slab allocation size instead of the
  148. whitelist size. This option will be removed once it seems like
  149. all missing usercopy whitelists have been identified and fixed.
  150. Booting with "slab_common.usercopy_fallback=Y/N" can change
  151. this setting.
  152. config HARDENED_USERCOPY_PAGESPAN
  153. bool "Refuse to copy allocations that span multiple pages"
  154. depends on HARDENED_USERCOPY
  155. depends on EXPERT
  156. help
  157. When a multi-page allocation is done without __GFP_COMP,
  158. hardened usercopy will reject attempts to copy it. There are,
  159. however, several cases of this in the kernel that have not all
  160. been removed. This config is intended to be used only while
  161. trying to find such users.
  162. config FORTIFY_SOURCE
  163. bool "Harden common str/mem functions against buffer overflows"
  164. depends on ARCH_HAS_FORTIFY_SOURCE
  165. # https://bugs.llvm.org/show_bug.cgi?id=50322
  166. # https://bugs.llvm.org/show_bug.cgi?id=41459
  167. depends on !CC_IS_CLANG
  168. help
  169. Detect overflows of buffers in common string and memory functions
  170. where the compiler can determine and validate the buffer sizes.
  171. config STATIC_USERMODEHELPER
  172. bool "Force all usermode helper calls through a single binary"
  173. help
  174. By default, the kernel can call many different userspace
  175. binary programs through the "usermode helper" kernel
  176. interface. Some of these binaries are statically defined
  177. either in the kernel code itself, or as a kernel configuration
  178. option. However, some of these are dynamically created at
  179. runtime, or can be modified after the kernel has started up.
  180. To provide an additional layer of security, route all of these
  181. calls through a single executable that can not have its name
  182. changed.
  183. Note, it is up to this single binary to then call the relevant
  184. "real" usermode helper binary, based on the first argument
  185. passed to it. If desired, this program can filter and pick
  186. and choose what real programs are called.
  187. If you wish for all usermode helper programs are to be
  188. disabled, choose this option and then set
  189. STATIC_USERMODEHELPER_PATH to an empty string.
  190. config STATIC_USERMODEHELPER_PATH
  191. string "Path to the static usermode helper binary"
  192. depends on STATIC_USERMODEHELPER
  193. default "/sbin/usermode-helper"
  194. help
  195. The binary called by the kernel when any usermode helper
  196. program is wish to be run. The "real" application's name will
  197. be in the first argument passed to this program on the command
  198. line.
  199. If you wish for all usermode helper programs to be disabled,
  200. specify an empty string here (i.e. "").
  201. source "security/selinux/Kconfig"
  202. source "security/smack/Kconfig"
  203. source "security/tomoyo/Kconfig"
  204. source "security/apparmor/Kconfig"
  205. source "security/loadpin/Kconfig"
  206. source "security/yama/Kconfig"
  207. source "security/safesetid/Kconfig"
  208. source "security/lockdown/Kconfig"
  209. source "security/integrity/Kconfig"
  210. choice
  211. prompt "First legacy 'major LSM' to be initialized"
  212. default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
  213. default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
  214. default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
  215. default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
  216. default DEFAULT_SECURITY_DAC
  217. help
  218. This choice is there only for converting CONFIG_DEFAULT_SECURITY
  219. in old kernel configs to CONFIG_LSM in new kernel configs. Don't
  220. change this choice unless you are creating a fresh kernel config,
  221. for this choice will be ignored after CONFIG_LSM has been set.
  222. Selects the legacy "major security module" that will be
  223. initialized first. Overridden by non-default CONFIG_LSM.
  224. config DEFAULT_SECURITY_SELINUX
  225. bool "SELinux" if SECURITY_SELINUX=y
  226. config DEFAULT_SECURITY_SMACK
  227. bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
  228. config DEFAULT_SECURITY_TOMOYO
  229. bool "TOMOYO" if SECURITY_TOMOYO=y
  230. config DEFAULT_SECURITY_APPARMOR
  231. bool "AppArmor" if SECURITY_APPARMOR=y
  232. config DEFAULT_SECURITY_DAC
  233. bool "Unix Discretionary Access Controls"
  234. endchoice
  235. config LSM
  236. string "Ordered list of enabled LSMs"
  237. default "lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK
  238. default "lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR
  239. default "lockdown,yama,loadpin,safesetid,integrity,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO
  240. default "lockdown,yama,loadpin,safesetid,integrity,bpf" if DEFAULT_SECURITY_DAC
  241. default "lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
  242. help
  243. A comma-separated list of LSMs, in initialization order.
  244. Any LSMs left off this list will be ignored. This can be
  245. controlled at boot with the "lsm=" parameter.
  246. If unsure, leave this as the default.
  247. source "security/Kconfig.hardening"
  248. endmenu