mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
![Iulia Manda](/assets/img/avatar_default.png)
There are a lot of embedded systems that run most or all of their functionality in init, running as root:root. For these systems, supporting multiple users is not necessary. This patch adds a new symbol, CONFIG_MULTIUSER, that makes support for non-root users, non-root groups, and capabilities optional. It is enabled under CONFIG_EXPERT menu. When this symbol is not defined, UID and GID are zero in any possible case and processes always have all capabilities. The following syscalls are compiled out: setuid, setregid, setgid, setreuid, setresuid, getresuid, setresgid, getresgid, setgroups, getgroups, setfsuid, setfsgid, capget, capset. Also, groups.c is compiled out completely. In kernel/capability.c, capable function was moved in order to avoid adding two ifdef blocks. This change saves about 25 KB on a defconfig build. The most minimal kernels have total text sizes in the high hundreds of kB rather than low MB. (The 25k goes down a bit with allnoconfig, but not that much. The kernel was booted in Qemu. All the common functionalities work. Adding users/groups is not possible, failing with -ENOSYS. Bloat-o-meter output: add/remove: 7/87 grow/shrink: 19/397 up/down: 1675/-26325 (-24650) [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Iulia Manda <iulia.manda21@gmail.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
172 lines
5.7 KiB
Text
172 lines
5.7 KiB
Text
#
|
|
# Security configuration
|
|
#
|
|
|
|
menu "Security options"
|
|
|
|
source security/keys/Kconfig
|
|
|
|
config SECURITY_DMESG_RESTRICT
|
|
bool "Restrict unprivileged access to the kernel syslog"
|
|
default n
|
|
help
|
|
This enforces restrictions on unprivileged users reading the kernel
|
|
syslog via dmesg(8).
|
|
|
|
If this option is not selected, no restrictions will be enforced
|
|
unless the dmesg_restrict sysctl is explicitly set to (1).
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITY
|
|
bool "Enable different security models"
|
|
depends on SYSFS
|
|
depends on MULTIUSER
|
|
help
|
|
This allows you to choose different security modules to be
|
|
configured into your kernel.
|
|
|
|
If this option is not selected, the default Linux security
|
|
model will be used.
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITYFS
|
|
bool "Enable the securityfs filesystem"
|
|
help
|
|
This will build the securityfs filesystem. It is currently used by
|
|
the TPM bios character driver and IMA, an integrity provider. It is
|
|
not used by SELinux or SMACK.
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITY_NETWORK
|
|
bool "Socket and Networking Security Hooks"
|
|
depends on SECURITY
|
|
help
|
|
This enables the socket and networking security hooks.
|
|
If enabled, a security module can use these hooks to
|
|
implement socket and networking access controls.
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITY_NETWORK_XFRM
|
|
bool "XFRM (IPSec) Networking Security Hooks"
|
|
depends on XFRM && SECURITY_NETWORK
|
|
help
|
|
This enables the XFRM (IPSec) networking security hooks.
|
|
If enabled, a security module can use these hooks to
|
|
implement per-packet access controls based on labels
|
|
derived from IPSec policy. Non-IPSec communications are
|
|
designated as unlabelled, and only sockets authorized
|
|
to communicate unlabelled data can send without using
|
|
IPSec.
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITY_PATH
|
|
bool "Security hooks for pathname based access control"
|
|
depends on SECURITY
|
|
help
|
|
This enables the security hooks for pathname based access control.
|
|
If enabled, a security module can use these hooks to
|
|
implement pathname based access controls.
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config INTEL_TXT
|
|
bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
|
|
depends on HAVE_INTEL_TXT
|
|
help
|
|
This option enables support for booting the kernel with the
|
|
Trusted Boot (tboot) module. This will utilize
|
|
Intel(R) Trusted Execution Technology to perform a measured launch
|
|
of the kernel. If the system does not support Intel(R) TXT, this
|
|
will have no effect.
|
|
|
|
Intel TXT will provide higher assurance of system configuration and
|
|
initial state as well as data reset protection. This is used to
|
|
create a robust initial kernel measurement and verification, which
|
|
helps to ensure that kernel security mechanisms are functioning
|
|
correctly. This level of protection requires a root of trust outside
|
|
of the kernel itself.
|
|
|
|
Intel TXT also helps solve real end user concerns about having
|
|
confidence that their hardware is running the VMM or kernel that
|
|
it was configured with, especially since they may be responsible for
|
|
providing such assurances to VMs and services running on it.
|
|
|
|
See <http://www.intel.com/technology/security/> for more information
|
|
about Intel(R) TXT.
|
|
See <http://tboot.sourceforge.net> for more information about tboot.
|
|
See Documentation/intel_txt.txt for a description of how to enable
|
|
Intel TXT support in a kernel boot.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
config LSM_MMAP_MIN_ADDR
|
|
int "Low address space for LSM to protect from user allocation"
|
|
depends on SECURITY && SECURITY_SELINUX
|
|
default 32768 if ARM || (ARM64 && COMPAT)
|
|
default 65536
|
|
help
|
|
This is the portion of low virtual memory which should be protected
|
|
from userspace allocation. Keeping a user from writing to low pages
|
|
can help reduce the impact of kernel NULL pointer bugs.
|
|
|
|
For most ia64, ppc64 and x86 users with lots of address space
|
|
a value of 65536 is reasonable and should cause no problems.
|
|
On arm and other archs it should not be higher than 32768.
|
|
Programs which use vm86 functionality or have some need to map
|
|
this low address space will need the permission specific to the
|
|
systems running LSM.
|
|
|
|
source security/selinux/Kconfig
|
|
source security/smack/Kconfig
|
|
source security/tomoyo/Kconfig
|
|
source security/apparmor/Kconfig
|
|
source security/yama/Kconfig
|
|
|
|
source security/integrity/Kconfig
|
|
|
|
choice
|
|
prompt "Default security module"
|
|
default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
|
|
default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
|
|
default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
|
|
default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
|
|
default DEFAULT_SECURITY_YAMA if SECURITY_YAMA
|
|
default DEFAULT_SECURITY_DAC
|
|
|
|
help
|
|
Select the security module that will be used by default if the
|
|
kernel parameter security= is not specified.
|
|
|
|
config DEFAULT_SECURITY_SELINUX
|
|
bool "SELinux" if SECURITY_SELINUX=y
|
|
|
|
config DEFAULT_SECURITY_SMACK
|
|
bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
|
|
|
|
config DEFAULT_SECURITY_TOMOYO
|
|
bool "TOMOYO" if SECURITY_TOMOYO=y
|
|
|
|
config DEFAULT_SECURITY_APPARMOR
|
|
bool "AppArmor" if SECURITY_APPARMOR=y
|
|
|
|
config DEFAULT_SECURITY_YAMA
|
|
bool "Yama" if SECURITY_YAMA=y
|
|
|
|
config DEFAULT_SECURITY_DAC
|
|
bool "Unix Discretionary Access Controls"
|
|
|
|
endchoice
|
|
|
|
config DEFAULT_SECURITY
|
|
string
|
|
default "selinux" if DEFAULT_SECURITY_SELINUX
|
|
default "smack" if DEFAULT_SECURITY_SMACK
|
|
default "tomoyo" if DEFAULT_SECURITY_TOMOYO
|
|
default "apparmor" if DEFAULT_SECURITY_APPARMOR
|
|
default "yama" if DEFAULT_SECURITY_YAMA
|
|
default "" if DEFAULT_SECURITY_DAC
|
|
|
|
endmenu
|
|
|