Root/
1 | config SECURITY_SELINUX |
2 | bool "NSA SELinux Support" |
3 | depends on SECURITY_NETWORK && AUDIT && NET && INET |
4 | select NETWORK_SECMARK |
5 | default n |
6 | help |
7 | This selects NSA Security-Enhanced Linux (SELinux). |
8 | You will also need a policy configuration and a labeled filesystem. |
9 | If you are unsure how to answer this question, answer N. |
10 | |
11 | config SECURITY_SELINUX_BOOTPARAM |
12 | bool "NSA SELinux boot parameter" |
13 | depends on SECURITY_SELINUX |
14 | default n |
15 | help |
16 | This option adds a kernel parameter 'selinux', which allows SELinux |
17 | to be disabled at boot. If this option is selected, SELinux |
18 | functionality can be disabled with selinux=0 on the kernel |
19 | command line. The purpose of this option is to allow a single |
20 | kernel image to be distributed with SELinux built in, but not |
21 | necessarily enabled. |
22 | |
23 | If you are unsure how to answer this question, answer N. |
24 | |
25 | config SECURITY_SELINUX_BOOTPARAM_VALUE |
26 | int "NSA SELinux boot parameter default value" |
27 | depends on SECURITY_SELINUX_BOOTPARAM |
28 | range 0 1 |
29 | default 1 |
30 | help |
31 | This option sets the default value for the kernel parameter |
32 | 'selinux', which allows SELinux to be disabled at boot. If this |
33 | option is set to 0 (zero), the SELinux kernel parameter will |
34 | default to 0, disabling SELinux at bootup. If this option is |
35 | set to 1 (one), the SELinux kernel parameter will default to 1, |
36 | enabling SELinux at bootup. |
37 | |
38 | If you are unsure how to answer this question, answer 1. |
39 | |
40 | config SECURITY_SELINUX_DISABLE |
41 | bool "NSA SELinux runtime disable" |
42 | depends on SECURITY_SELINUX |
43 | default n |
44 | help |
45 | This option enables writing to a selinuxfs node 'disable', which |
46 | allows SELinux to be disabled at runtime prior to the policy load. |
47 | SELinux will then remain disabled until the next boot. |
48 | This option is similar to the selinux=0 boot parameter, but is to |
49 | support runtime disabling of SELinux, e.g. from /sbin/init, for |
50 | portability across platforms where boot parameters are difficult |
51 | to employ. |
52 | |
53 | If you are unsure how to answer this question, answer N. |
54 | |
55 | config SECURITY_SELINUX_DEVELOP |
56 | bool "NSA SELinux Development Support" |
57 | depends on SECURITY_SELINUX |
58 | default y |
59 | help |
60 | This enables the development support option of NSA SELinux, |
61 | which is useful for experimenting with SELinux and developing |
62 | policies. If unsure, say Y. With this option enabled, the |
63 | kernel will start in permissive mode (log everything, deny nothing) |
64 | unless you specify enforcing=1 on the kernel command line. You |
65 | can interactively toggle the kernel between enforcing mode and |
66 | permissive mode (if permitted by the policy) via /selinux/enforce. |
67 | |
68 | config SECURITY_SELINUX_AVC_STATS |
69 | bool "NSA SELinux AVC Statistics" |
70 | depends on SECURITY_SELINUX |
71 | default y |
72 | help |
73 | This option collects access vector cache statistics to |
74 | /selinux/avc/cache_stats, which may be monitored via |
75 | tools such as avcstat. |
76 | |
77 | config SECURITY_SELINUX_CHECKREQPROT_VALUE |
78 | int "NSA SELinux checkreqprot default value" |
79 | depends on SECURITY_SELINUX |
80 | range 0 1 |
81 | default 1 |
82 | help |
83 | This option sets the default value for the 'checkreqprot' flag |
84 | that determines whether SELinux checks the protection requested |
85 | by the application or the protection that will be applied by the |
86 | kernel (including any implied execute for read-implies-exec) for |
87 | mmap and mprotect calls. If this option is set to 0 (zero), |
88 | SELinux will default to checking the protection that will be applied |
89 | by the kernel. If this option is set to 1 (one), SELinux will |
90 | default to checking the protection requested by the application. |
91 | The checkreqprot flag may be changed from the default via the |
92 | 'checkreqprot=' boot parameter. It may also be changed at runtime |
93 | via /selinux/checkreqprot if authorized by policy. |
94 | |
95 | If you are unsure how to answer this question, answer 1. |
96 | |
97 | config SECURITY_SELINUX_POLICYDB_VERSION_MAX |
98 | bool "NSA SELinux maximum supported policy format version" |
99 | depends on SECURITY_SELINUX |
100 | default n |
101 | help |
102 | This option enables the maximum policy format version supported |
103 | by SELinux to be set to a particular value. This value is reported |
104 | to userspace via /selinux/policyvers and used at policy load time. |
105 | It can be adjusted downward to support legacy userland (init) that |
106 | does not correctly handle kernels that support newer policy versions. |
107 | |
108 | Examples: |
109 | For the Fedora Core 3 or 4 Linux distributions, enable this option |
110 | and set the value via the next option. For Fedora Core 5 and later, |
111 | do not enable this option. |
112 | |
113 | If you are unsure how to answer this question, answer N. |
114 | |
115 | config SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE |
116 | int "NSA SELinux maximum supported policy format version value" |
117 | depends on SECURITY_SELINUX_POLICYDB_VERSION_MAX |
118 | range 15 23 |
119 | default 19 |
120 | help |
121 | This option sets the value for the maximum policy format version |
122 | supported by SELinux. |
123 | |
124 | Examples: |
125 | For Fedora Core 3, use 18. |
126 | For Fedora Core 4, use 19. |
127 | |
128 | If you are unsure how to answer this question, look for the |
129 | policy format version supported by your policy toolchain, by |
130 | running 'checkpolicy -V'. Or look at what policy you have |
131 | installed under /etc/selinux/$SELINUXTYPE/policy, where |
132 | SELINUXTYPE is defined in your /etc/selinux/config. |
133 | |
134 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9