hc
2024-10-22 8ac6c7a54ed1b98d142dce24b11c6de6a1e239a5
kernel/security/selinux/Kconfig
....@@ -1,3 +1,4 @@
1
+# SPDX-License-Identifier: GPL-2.0-only
12 config SECURITY_SELINUX
23 bool "NSA SELinux Support"
34 depends on SECURITY_NETWORK && AUDIT && NET && INET
....@@ -22,21 +23,6 @@
2223
2324 If you are unsure how to answer this question, answer N.
2425
25
-config SECURITY_SELINUX_BOOTPARAM_VALUE
26
- int "NSA SELinux boot parameter default value"
27
- depends on SECURITY_SELINUX_BOOTPARAM
28
- range 0 1
29
- default 1
30
- help
31
- This option sets the default value for the kernel parameter
32
- 'selinux', which allows SELinux to be disabled at boot. If this
33
- option is set to 0 (zero), the SELinux kernel parameter will
34
- default to 0, disabling SELinux at bootup. If this option is
35
- set to 1 (one), the SELinux kernel parameter will default to 1,
36
- enabling SELinux at bootup.
37
-
38
- If you are unsure how to answer this question, answer 1.
39
-
4026 config SECURITY_SELINUX_DISABLE
4127 bool "NSA SELinux runtime disable"
4228 depends on SECURITY_SELINUX
....@@ -56,6 +42,9 @@
5642 using the selinux=0 boot parameter instead of enabling this
5743 option.
5844
45
+ WARNING: this option is deprecated and will be removed in a future
46
+ kernel release.
47
+
5948 If you are unsure how to answer this question, answer N.
6049
6150 config SECURITY_SELINUX_DEVELOP
....@@ -69,7 +58,8 @@
6958 kernel will start in permissive mode (log everything, deny nothing)
7059 unless you specify enforcing=1 on the kernel command line. You
7160 can interactively toggle the kernel between enforcing mode and
72
- permissive mode (if permitted by the policy) via /selinux/enforce.
61
+ permissive mode (if permitted by the policy) via
62
+ /sys/fs/selinux/enforce.
7363
7464 config SECURITY_SELINUX_AVC_STATS
7565 bool "NSA SELinux AVC Statistics"
....@@ -77,7 +67,7 @@
7767 default y
7868 help
7969 This option collects access vector cache statistics to
80
- /selinux/avc/cache_stats, which may be monitored via
70
+ /sys/fs/selinux/avc/cache_stats, which may be monitored via
8171 tools such as avcstat.
8272
8373 config SECURITY_SELINUX_CHECKREQPROT_VALUE
....@@ -96,7 +86,10 @@
9686 default to checking the protection requested by the application.
9787 The checkreqprot flag may be changed from the default via the
9888 'checkreqprot=' boot parameter. It may also be changed at runtime
99
- via /selinux/checkreqprot if authorized by policy.
89
+ via /sys/fs/selinux/checkreqprot if authorized by policy.
90
+
91
+ WARNING: this option is deprecated and will be removed in a future
92
+ kernel release.
10093
10194 If you are unsure how to answer this question, answer 0.
10295
....@@ -111,3 +104,14 @@
111104 collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If
112105 chain lengths are high (e.g. > 20) then selecting a higher value here
113106 will ensure that lookups times are short and stable.
107
+
108
+config SECURITY_SELINUX_SID2STR_CACHE_SIZE
109
+ int "NSA SELinux SID to context string translation cache size"
110
+ depends on SECURITY_SELINUX
111
+ default 256
112
+ help
113
+ This option defines the size of the internal SID -> context string
114
+ cache, which improves the performance of context to string
115
+ conversion. Setting this option to 0 disables the cache completely.
116
+
117
+ If unsure, keep the default value.