1*4882a593Smuzhiyunconfig SECURITY_LOCKDOWN_LSM 2*4882a593Smuzhiyun bool "Basic module for enforcing kernel lockdown" 3*4882a593Smuzhiyun depends on SECURITY 4*4882a593Smuzhiyun select MODULE_SIG if MODULES 5*4882a593Smuzhiyun help 6*4882a593Smuzhiyun Build support for an LSM that enforces a coarse kernel lockdown 7*4882a593Smuzhiyun behaviour. 8*4882a593Smuzhiyun 9*4882a593Smuzhiyunconfig SECURITY_LOCKDOWN_LSM_EARLY 10*4882a593Smuzhiyun bool "Enable lockdown LSM early in init" 11*4882a593Smuzhiyun depends on SECURITY_LOCKDOWN_LSM 12*4882a593Smuzhiyun help 13*4882a593Smuzhiyun Enable the lockdown LSM early in boot. This is necessary in order 14*4882a593Smuzhiyun to ensure that lockdown enforcement can be carried out on kernel 15*4882a593Smuzhiyun boot parameters that are otherwise parsed before the security 16*4882a593Smuzhiyun subsystem is fully initialised. If enabled, lockdown will 17*4882a593Smuzhiyun unconditionally be called before any other LSMs. 18*4882a593Smuzhiyun 19*4882a593Smuzhiyunchoice 20*4882a593Smuzhiyun prompt "Kernel default lockdown mode" 21*4882a593Smuzhiyun default LOCK_DOWN_KERNEL_FORCE_NONE 22*4882a593Smuzhiyun depends on SECURITY_LOCKDOWN_LSM 23*4882a593Smuzhiyun help 24*4882a593Smuzhiyun The kernel can be configured to default to differing levels of 25*4882a593Smuzhiyun lockdown. 26*4882a593Smuzhiyun 27*4882a593Smuzhiyunconfig LOCK_DOWN_KERNEL_FORCE_NONE 28*4882a593Smuzhiyun bool "None" 29*4882a593Smuzhiyun help 30*4882a593Smuzhiyun No lockdown functionality is enabled by default. Lockdown may be 31*4882a593Smuzhiyun enabled via the kernel commandline or /sys/kernel/security/lockdown. 32*4882a593Smuzhiyun 33*4882a593Smuzhiyunconfig LOCK_DOWN_KERNEL_FORCE_INTEGRITY 34*4882a593Smuzhiyun bool "Integrity" 35*4882a593Smuzhiyun help 36*4882a593Smuzhiyun The kernel runs in integrity mode by default. Features that allow 37*4882a593Smuzhiyun the kernel to be modified at runtime are disabled. 38*4882a593Smuzhiyun 39*4882a593Smuzhiyunconfig LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY 40*4882a593Smuzhiyun bool "Confidentiality" 41*4882a593Smuzhiyun help 42*4882a593Smuzhiyun The kernel runs in confidentiality mode by default. Features that 43*4882a593Smuzhiyun allow the kernel to be modified at runtime or that permit userland 44*4882a593Smuzhiyun code to read confidential material held inside the kernel are 45*4882a593Smuzhiyun disabled. 46*4882a593Smuzhiyun 47*4882a593Smuzhiyunendchoice 48