From d2ccde1c8e90d38cee87a1b0309ad2827f3fd30d Mon Sep 17 00:00:00 2001 From: hc <hc@nodka.com> Date: Mon, 11 Dec 2023 02:45:28 +0000 Subject: [PATCH] add boot partition size --- kernel/security/Kconfig | 78 +++++++++++++++++--------------------- 1 files changed, 35 insertions(+), 43 deletions(-) diff --git a/kernel/security/Kconfig b/kernel/security/Kconfig index 23f0687..9893c31 100644 --- a/kernel/security/Kconfig +++ b/kernel/security/Kconfig @@ -1,10 +1,11 @@ +# SPDX-License-Identifier: GPL-2.0-only # # Security configuration # menu "Security options" -source security/keys/Kconfig +source "security/keys/Kconfig" config SECURITY_DMESG_RESTRICT bool "Restrict unprivileged access to the kernel syslog" @@ -17,15 +18,6 @@ unless the dmesg_restrict sysctl is explicitly set to (1). If you are unsure how to answer this question, answer N. - -config SECURITY_PERF_EVENTS_RESTRICT - bool "Restrict unprivileged use of performance events" - depends on PERF_EVENTS - help - If you say Y here, the kernel.perf_event_paranoid sysctl - will be set to 3 by default, and no unprivileged use of the - perf_event_open syscall will be permitted unless it is - changed. config SECURITY bool "Enable different security models" @@ -49,8 +41,7 @@ bool "Enable the securityfs filesystem" help This will build the securityfs filesystem. It is currently used by - the TPM bios character driver and IMA, an integrity provider. It is - not used by SELinux or SMACK. + various security modules (AppArmor, IMA, SafeSetID, TOMOYO, TPM). If you are unsure how to answer this question, answer N. @@ -62,17 +53,6 @@ If enabled, a security module can use these hooks to implement socket and networking access controls. If you are unsure how to answer this question, answer N. - -config PAGE_TABLE_ISOLATION - bool "Remove the kernel mapping in user mode" - default y - depends on (X86_64 || X86_PAE) && !UML - help - This feature reduces the number of hardware side channels by - ensuring that the majority of kernel addresses are not mapped - into userspace. - - See Documentation/x86/pti.txt for more details. config SECURITY_INFINIBAND bool "Infiniband Security Hooks" @@ -127,10 +107,10 @@ it was configured with, especially since they may be responsible for providing such assurances to VMs and services running on it. - See <http://www.intel.com/technology/security/> for more information + See <https://www.intel.com/technology/security/> for more information about Intel(R) TXT. See <http://tboot.sourceforge.net> for more information about tboot. - See Documentation/intel_txt.txt for a description of how to enable + See Documentation/x86/intel_txt.rst for a description of how to enable Intel TXT support in a kernel boot. If you are unsure as to whether this is required, answer N. @@ -242,18 +222,19 @@ If you wish for all usermode helper programs to be disabled, specify an empty string here (i.e. ""). -source security/selinux/Kconfig -source security/smack/Kconfig -source security/tomoyo/Kconfig -source security/apparmor/Kconfig -source security/loadpin/Kconfig -source security/yama/Kconfig -source security/optee_linuxdriver/Kconfig +source "security/selinux/Kconfig" +source "security/smack/Kconfig" +source "security/tomoyo/Kconfig" +source "security/apparmor/Kconfig" +source "security/loadpin/Kconfig" +source "security/yama/Kconfig" +source "security/safesetid/Kconfig" +source "security/lockdown/Kconfig" -source security/integrity/Kconfig +source "security/integrity/Kconfig" choice - prompt "Default security module" + prompt "First legacy 'major LSM' to be initialized" default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX default DEFAULT_SECURITY_SMACK if SECURITY_SMACK default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO @@ -261,8 +242,13 @@ default DEFAULT_SECURITY_DAC help - Select the security module that will be used by default if the - kernel parameter security= is not specified. + This choice is there only for converting CONFIG_DEFAULT_SECURITY + in old kernel configs to CONFIG_LSM in new kernel configs. Don't + change this choice unless you are creating a fresh kernel config, + for this choice will be ignored after CONFIG_LSM has been set. + + Selects the legacy "major security module" that will be + initialized first. Overridden by non-default CONFIG_LSM. config DEFAULT_SECURITY_SELINUX bool "SELinux" if SECURITY_SELINUX=y @@ -281,13 +267,19 @@ endchoice -config DEFAULT_SECURITY - string - default "selinux" if DEFAULT_SECURITY_SELINUX - default "smack" if DEFAULT_SECURITY_SMACK - default "tomoyo" if DEFAULT_SECURITY_TOMOYO - default "apparmor" if DEFAULT_SECURITY_APPARMOR - default "" if DEFAULT_SECURITY_DAC +config LSM + string "Ordered list of enabled LSMs" + default "lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK + default "lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR + default "lockdown,yama,loadpin,safesetid,integrity,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO + default "lockdown,yama,loadpin,safesetid,integrity,bpf" if DEFAULT_SECURITY_DAC + default "lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" + help + A comma-separated list of LSMs, in initialization order. + Any LSMs left off this list will be ignored. This can be + controlled at boot with the "lsm=" parameter. + + If unsure, leave this as the default. source "security/Kconfig.hardening" -- Gitblit v1.6.2