1*4882a593Smuzhiyun# SPDX-License-Identifier: GPL-2.0-only 2*4882a593Smuzhiyunconfig SECURITY_APPARMOR 3*4882a593Smuzhiyun bool "AppArmor support" 4*4882a593Smuzhiyun depends on SECURITY && NET 5*4882a593Smuzhiyun select AUDIT 6*4882a593Smuzhiyun select SECURITY_PATH 7*4882a593Smuzhiyun select SECURITYFS 8*4882a593Smuzhiyun select SECURITY_NETWORK 9*4882a593Smuzhiyun select ZLIB_INFLATE 10*4882a593Smuzhiyun select ZLIB_DEFLATE 11*4882a593Smuzhiyun default n 12*4882a593Smuzhiyun help 13*4882a593Smuzhiyun This enables the AppArmor security module. 14*4882a593Smuzhiyun Required userspace tools (if they are not included in your 15*4882a593Smuzhiyun distribution) and further information may be found at 16*4882a593Smuzhiyun http://apparmor.wiki.kernel.org 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun If you are unsure how to answer this question, answer N. 19*4882a593Smuzhiyun 20*4882a593Smuzhiyunconfig SECURITY_APPARMOR_HASH 21*4882a593Smuzhiyun bool "Enable introspection of sha1 hashes for loaded profiles" 22*4882a593Smuzhiyun depends on SECURITY_APPARMOR 23*4882a593Smuzhiyun select CRYPTO 24*4882a593Smuzhiyun select CRYPTO_SHA1 25*4882a593Smuzhiyun default y 26*4882a593Smuzhiyun help 27*4882a593Smuzhiyun This option selects whether introspection of loaded policy 28*4882a593Smuzhiyun is available to userspace via the apparmor filesystem. 29*4882a593Smuzhiyun 30*4882a593Smuzhiyunconfig SECURITY_APPARMOR_HASH_DEFAULT 31*4882a593Smuzhiyun bool "Enable policy hash introspection by default" 32*4882a593Smuzhiyun depends on SECURITY_APPARMOR_HASH 33*4882a593Smuzhiyun default y 34*4882a593Smuzhiyun help 35*4882a593Smuzhiyun This option selects whether sha1 hashing of loaded policy 36*4882a593Smuzhiyun is enabled by default. The generation of sha1 hashes for 37*4882a593Smuzhiyun loaded policy provide system administrators a quick way 38*4882a593Smuzhiyun to verify that policy in the kernel matches what is expected, 39*4882a593Smuzhiyun however it can slow down policy load on some devices. In 40*4882a593Smuzhiyun these cases policy hashing can be disabled by default and 41*4882a593Smuzhiyun enabled only if needed. 42*4882a593Smuzhiyun 43*4882a593Smuzhiyunconfig SECURITY_APPARMOR_DEBUG 44*4882a593Smuzhiyun bool "Build AppArmor with debug code" 45*4882a593Smuzhiyun depends on SECURITY_APPARMOR 46*4882a593Smuzhiyun default n 47*4882a593Smuzhiyun help 48*4882a593Smuzhiyun Build apparmor with debugging logic in apparmor. Not all 49*4882a593Smuzhiyun debugging logic will necessarily be enabled. A submenu will 50*4882a593Smuzhiyun provide fine grained control of the debug options that are 51*4882a593Smuzhiyun available. 52*4882a593Smuzhiyun 53*4882a593Smuzhiyunconfig SECURITY_APPARMOR_DEBUG_ASSERTS 54*4882a593Smuzhiyun bool "Build AppArmor with debugging asserts" 55*4882a593Smuzhiyun depends on SECURITY_APPARMOR_DEBUG 56*4882a593Smuzhiyun default y 57*4882a593Smuzhiyun help 58*4882a593Smuzhiyun Enable code assertions made with AA_BUG. These are primarily 59*4882a593Smuzhiyun function entry preconditions but also exist at other key 60*4882a593Smuzhiyun points. If the assert is triggered it will trigger a WARN 61*4882a593Smuzhiyun message. 62*4882a593Smuzhiyun 63*4882a593Smuzhiyunconfig SECURITY_APPARMOR_DEBUG_MESSAGES 64*4882a593Smuzhiyun bool "Debug messages enabled by default" 65*4882a593Smuzhiyun depends on SECURITY_APPARMOR_DEBUG 66*4882a593Smuzhiyun default n 67*4882a593Smuzhiyun help 68*4882a593Smuzhiyun Set the default value of the apparmor.debug kernel parameter. 69*4882a593Smuzhiyun When enabled, various debug messages will be logged to 70*4882a593Smuzhiyun the kernel message buffer. 71*4882a593Smuzhiyun 72*4882a593Smuzhiyunconfig SECURITY_APPARMOR_KUNIT_TEST 73*4882a593Smuzhiyun bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS 74*4882a593Smuzhiyun depends on KUNIT=y && SECURITY_APPARMOR 75*4882a593Smuzhiyun default KUNIT_ALL_TESTS 76*4882a593Smuzhiyun help 77*4882a593Smuzhiyun This builds the AppArmor KUnit tests. 78*4882a593Smuzhiyun 79*4882a593Smuzhiyun KUnit tests run during boot and output the results to the debug log 80*4882a593Smuzhiyun in TAP format (https://testanything.org/). Only useful for kernel devs 81*4882a593Smuzhiyun running KUnit test harness and are not for inclusion into a 82*4882a593Smuzhiyun production build. 83*4882a593Smuzhiyun 84*4882a593Smuzhiyun For more information on KUnit and unit tests in general please refer 85*4882a593Smuzhiyun to the KUnit documentation in Documentation/dev-tools/kunit/. 86*4882a593Smuzhiyun 87*4882a593Smuzhiyun If unsure, say N. 88