Kconfig 1.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647
  1. config SECURITY_LOCKDOWN_LSM
  2. bool "Basic module for enforcing kernel lockdown"
  3. depends on SECURITY
  4. select MODULE_SIG if MODULES
  5. help
  6. Build support for an LSM that enforces a coarse kernel lockdown
  7. behaviour.
  8. config SECURITY_LOCKDOWN_LSM_EARLY
  9. bool "Enable lockdown LSM early in init"
  10. depends on SECURITY_LOCKDOWN_LSM
  11. help
  12. Enable the lockdown LSM early in boot. This is necessary in order
  13. to ensure that lockdown enforcement can be carried out on kernel
  14. boot parameters that are otherwise parsed before the security
  15. subsystem is fully initialised. If enabled, lockdown will
  16. unconditionally be called before any other LSMs.
  17. choice
  18. prompt "Kernel default lockdown mode"
  19. default LOCK_DOWN_KERNEL_FORCE_NONE
  20. depends on SECURITY_LOCKDOWN_LSM
  21. help
  22. The kernel can be configured to default to differing levels of
  23. lockdown.
  24. config LOCK_DOWN_KERNEL_FORCE_NONE
  25. bool "None"
  26. help
  27. No lockdown functionality is enabled by default. Lockdown may be
  28. enabled via the kernel commandline or /sys/kernel/security/lockdown.
  29. config LOCK_DOWN_KERNEL_FORCE_INTEGRITY
  30. bool "Integrity"
  31. help
  32. The kernel runs in integrity mode by default. Features that allow
  33. the kernel to be modified at runtime are disabled.
  34. config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
  35. bool "Confidentiality"
  36. help
  37. The kernel runs in confidentiality mode by default. Features that
  38. allow the kernel to be modified at runtime or that permit userland
  39. code to read confidential material held inside the kernel are
  40. disabled.
  41. endchoice