.. | .. |
---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | config SECURITY_TOMOYO |
---|
2 | 3 | bool "TOMOYO Linux Support" |
---|
3 | 4 | depends on SECURITY |
---|
.. | .. |
---|
42 | 43 | bool "Activate without calling userspace policy loader." |
---|
43 | 44 | default n |
---|
44 | 45 | depends on SECURITY_TOMOYO |
---|
45 | | - ---help--- |
---|
| 46 | + help |
---|
46 | 47 | Say Y here if you want to activate access control as soon as built-in |
---|
47 | 48 | policy was loaded. This option will be useful for systems where |
---|
48 | 49 | operations which can lead to the hijacking of the boot sequence are |
---|
.. | .. |
---|
59 | 60 | default "/sbin/tomoyo-init" |
---|
60 | 61 | depends on SECURITY_TOMOYO |
---|
61 | 62 | depends on !SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
---|
62 | | - ---help--- |
---|
| 63 | + help |
---|
63 | 64 | This is the default pathname of policy loader which is called before |
---|
64 | 65 | activation. You can override this setting via TOMOYO_loader= kernel |
---|
65 | 66 | command line option. |
---|
.. | .. |
---|
69 | 70 | default "/sbin/init" |
---|
70 | 71 | depends on SECURITY_TOMOYO |
---|
71 | 72 | depends on !SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
---|
72 | | - ---help--- |
---|
| 73 | + help |
---|
73 | 74 | This is the default pathname of activation trigger. |
---|
74 | 75 | You can override this setting via TOMOYO_trigger= kernel command line |
---|
75 | 76 | option. For example, if you pass init=/bin/systemd option, you may |
---|
76 | 77 | want to also pass TOMOYO_trigger=/bin/systemd option. |
---|
| 78 | + |
---|
| 79 | +config SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING |
---|
| 80 | + bool "Use insecure built-in settings for fuzzing tests." |
---|
| 81 | + default n |
---|
| 82 | + depends on SECURITY_TOMOYO |
---|
| 83 | + select SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
---|
| 84 | + help |
---|
| 85 | + Enabling this option forces minimal built-in policy and disables |
---|
| 86 | + domain/program checks for run-time policy modifications. Please enable |
---|
| 87 | + this option only if this kernel is built for doing fuzzing tests. |
---|