1234567891011121314151617181920212223242526272829303132333435363738394041424344454647 |
- config SECURITY_LOCKDOWN_LSM
- bool "Basic module for enforcing kernel lockdown"
- depends on SECURITY
- select MODULE_SIG if MODULES
- help
- Build support for an LSM that enforces a coarse kernel lockdown
- behaviour.
- config SECURITY_LOCKDOWN_LSM_EARLY
- bool "Enable lockdown LSM early in init"
- depends on SECURITY_LOCKDOWN_LSM
- help
- Enable the lockdown LSM early in boot. This is necessary in order
- to ensure that lockdown enforcement can be carried out on kernel
- boot parameters that are otherwise parsed before the security
- subsystem is fully initialised. If enabled, lockdown will
- unconditionally be called before any other LSMs.
- choice
- prompt "Kernel default lockdown mode"
- default LOCK_DOWN_KERNEL_FORCE_NONE
- depends on SECURITY_LOCKDOWN_LSM
- help
- The kernel can be configured to default to differing levels of
- lockdown.
- config LOCK_DOWN_KERNEL_FORCE_NONE
- bool "None"
- help
- No lockdown functionality is enabled by default. Lockdown may be
- enabled via the kernel commandline or /sys/kernel/security/lockdown.
- config LOCK_DOWN_KERNEL_FORCE_INTEGRITY
- bool "Integrity"
- help
- The kernel runs in integrity mode by default. Features that allow
- the kernel to be modified at runtime are disabled.
- config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
- bool "Confidentiality"
- help
- The kernel runs in confidentiality mode by default. Features that
- allow the kernel to be modified at runtime or that permit userland
- code to read confidential material held inside the kernel are
- disabled.
- endchoice
|