LXR linux/security/apparmor/Kconfig

   1# SPDX-License-Identifier: GPL-2.0-only
   2config SECURITY_APPARMOR
   3        bool "AppArmor support"
   4        depends on SECURITY && NET
   5        select AUDIT
   6        select SECURITY_PATH
   7        select SECURITYFS
   8        select SECURITY_NETWORK
   9        default n
  10        help
  11          This enables the AppArmor security module.
  12          Required userspace tools (if they are not included in your
  13          distribution) and further information may be found at
  14          http://apparmor.wiki.kernel.org
  15
  16          If you are unsure how to answer this question, answer N.
  17
  18config SECURITY_APPARMOR_HASH
  19        bool "Enable introspection of sha1 hashes for loaded profiles"
  20        depends on SECURITY_APPARMOR
  21        select CRYPTO
  22        select CRYPTO_SHA1
  23        default y
  24        help
  25          This option selects whether introspection of loaded policy
  26          is available to userspace via the apparmor filesystem.
  27
  28config SECURITY_APPARMOR_HASH_DEFAULT
  29       bool "Enable policy hash introspection by default"
  30       depends on SECURITY_APPARMOR_HASH
  31       default y
  32       help
  33         This option selects whether sha1 hashing of loaded policy
  34         is enabled by default. The generation of sha1 hashes for
  35         loaded policy provide system administrators a quick way
  36         to verify that policy in the kernel matches what is expected,
  37         however it can slow down policy load on some devices. In
  38         these cases policy hashing can be disabled by default and
  39         enabled only if needed.
  40
  41config SECURITY_APPARMOR_DEBUG
  42        bool "Build AppArmor with debug code"
  43        depends on SECURITY_APPARMOR
  44        default n
  45        help
  46          Build apparmor with debugging logic in apparmor. Not all
  47          debugging logic will necessarily be enabled. A submenu will
  48          provide fine grained control of the debug options that are
  49          available.
  50
  51config SECURITY_APPARMOR_DEBUG_ASSERTS
  52        bool "Build AppArmor with debugging asserts"
  53        depends on SECURITY_APPARMOR_DEBUG
  54        default y
  55        help
  56          Enable code assertions made with AA_BUG. These are primarily
  57          function entry preconditions but also exist at other key
  58          points. If the assert is triggered it will trigger a WARN
  59          message.
  60
  61config SECURITY_APPARMOR_DEBUG_MESSAGES
  62        bool "Debug messages enabled by default"
  63        depends on SECURITY_APPARMOR_DEBUG
  64        default n
  65        help
  66          Set the default value of the apparmor.debug kernel parameter.
  67          When enabled, various debug messages will be logged to
  68          the kernel message buffer.
  69