# SPDX-License-Identifier: GPL-2.0-only
|
config SECURITY_APPARMOR
|
bool "AppArmor support"
|
depends on SECURITY && NET
|
select AUDIT
|
select SECURITY_PATH
|
select SECURITYFS
|
select SECURITY_NETWORK
|
select ZLIB_INFLATE
|
select ZLIB_DEFLATE
|
default n
|
help
|
This enables the AppArmor security module.
|
Required userspace tools (if they are not included in your
|
distribution) and further information may be found at
|
http://apparmor.wiki.kernel.org
|
|
If you are unsure how to answer this question, answer N.
|
|
config SECURITY_APPARMOR_HASH
|
bool "Enable introspection of sha1 hashes for loaded profiles"
|
depends on SECURITY_APPARMOR
|
select CRYPTO
|
select CRYPTO_SHA1
|
default y
|
help
|
This option selects whether introspection of loaded policy
|
is available to userspace via the apparmor filesystem.
|
|
config SECURITY_APPARMOR_HASH_DEFAULT
|
bool "Enable policy hash introspection by default"
|
depends on SECURITY_APPARMOR_HASH
|
default y
|
help
|
This option selects whether sha1 hashing of loaded policy
|
is enabled by default. The generation of sha1 hashes for
|
loaded policy provide system administrators a quick way
|
to verify that policy in the kernel matches what is expected,
|
however it can slow down policy load on some devices. In
|
these cases policy hashing can be disabled by default and
|
enabled only if needed.
|
|
config SECURITY_APPARMOR_DEBUG
|
bool "Build AppArmor with debug code"
|
depends on SECURITY_APPARMOR
|
default n
|
help
|
Build apparmor with debugging logic in apparmor. Not all
|
debugging logic will necessarily be enabled. A submenu will
|
provide fine grained control of the debug options that are
|
available.
|
|
config SECURITY_APPARMOR_DEBUG_ASSERTS
|
bool "Build AppArmor with debugging asserts"
|
depends on SECURITY_APPARMOR_DEBUG
|
default y
|
help
|
Enable code assertions made with AA_BUG. These are primarily
|
function entry preconditions but also exist at other key
|
points. If the assert is triggered it will trigger a WARN
|
message.
|
|
config SECURITY_APPARMOR_DEBUG_MESSAGES
|
bool "Debug messages enabled by default"
|
depends on SECURITY_APPARMOR_DEBUG
|
default n
|
help
|
Set the default value of the apparmor.debug kernel parameter.
|
When enabled, various debug messages will be logged to
|
the kernel message buffer.
|
|
config SECURITY_APPARMOR_KUNIT_TEST
|
bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
|
depends on KUNIT=y && SECURITY_APPARMOR
|
default KUNIT_ALL_TESTS
|
help
|
This builds the AppArmor KUnit tests.
|
|
KUnit tests run during boot and output the results to the debug log
|
in TAP format (https://testanything.org/). Only useful for kernel devs
|
running KUnit test harness and are not for inclusion into a
|
production build.
|
|
For more information on KUnit and unit tests in general please refer
|
to the KUnit documentation in Documentation/dev-tools/kunit/.
|
|
If unsure, say N.
|
