Kconfig 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. config SECURITY_APPARMOR
  3. bool "AppArmor support"
  4. depends on SECURITY && NET
  5. select AUDIT
  6. select SECURITY_PATH
  7. select SECURITYFS
  8. select SECURITY_NETWORK
  9. select ZLIB_INFLATE
  10. select ZLIB_DEFLATE
  11. default n
  12. help
  13. This enables the AppArmor security module.
  14. Required userspace tools (if they are not included in your
  15. distribution) and further information may be found at
  16. http://apparmor.wiki.kernel.org
  17. If you are unsure how to answer this question, answer N.
  18. config SECURITY_APPARMOR_HASH
  19. bool "Enable introspection of sha1 hashes for loaded profiles"
  20. depends on SECURITY_APPARMOR
  21. select CRYPTO
  22. select CRYPTO_SHA1
  23. default y
  24. help
  25. This option selects whether introspection of loaded policy
  26. is available to userspace via the apparmor filesystem.
  27. config SECURITY_APPARMOR_HASH_DEFAULT
  28. bool "Enable policy hash introspection by default"
  29. depends on SECURITY_APPARMOR_HASH
  30. default y
  31. help
  32. This option selects whether sha1 hashing of loaded policy
  33. is enabled by default. The generation of sha1 hashes for
  34. loaded policy provide system administrators a quick way
  35. to verify that policy in the kernel matches what is expected,
  36. however it can slow down policy load on some devices. In
  37. these cases policy hashing can be disabled by default and
  38. enabled only if needed.
  39. config SECURITY_APPARMOR_DEBUG
  40. bool "Build AppArmor with debug code"
  41. depends on SECURITY_APPARMOR
  42. default n
  43. help
  44. Build apparmor with debugging logic in apparmor. Not all
  45. debugging logic will necessarily be enabled. A submenu will
  46. provide fine grained control of the debug options that are
  47. available.
  48. config SECURITY_APPARMOR_DEBUG_ASSERTS
  49. bool "Build AppArmor with debugging asserts"
  50. depends on SECURITY_APPARMOR_DEBUG
  51. default y
  52. help
  53. Enable code assertions made with AA_BUG. These are primarily
  54. function entry preconditions but also exist at other key
  55. points. If the assert is triggered it will trigger a WARN
  56. message.
  57. config SECURITY_APPARMOR_DEBUG_MESSAGES
  58. bool "Debug messages enabled by default"
  59. depends on SECURITY_APPARMOR_DEBUG
  60. default n
  61. help
  62. Set the default value of the apparmor.debug kernel parameter.
  63. When enabled, various debug messages will be logged to
  64. the kernel message buffer.
  65. config SECURITY_APPARMOR_KUNIT_TEST
  66. bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
  67. depends on KUNIT=y && SECURITY_APPARMOR
  68. default KUNIT_ALL_TESTS
  69. help
  70. This builds the AppArmor KUnit tests.
  71. KUnit tests run during boot and output the results to the debug log
  72. in TAP format (https://testanything.org/). Only useful for kernel devs
  73. running KUnit test harness and are not for inclusion into a
  74. production build.
  75. For more information on KUnit and unit tests in general please refer
  76. to the KUnit documentation in Documentation/dev-tools/kunit/.
  77. If unsure, say N.