LXR linux/security/safesetid/Kconfig

   1# SPDX-License-Identifier: GPL-2.0-only
   2config SECURITY_SAFESETID
   3        bool "Gate setid transitions to limit CAP_SET{U/G}ID capabilities"
   4        depends on SECURITY
   5        select SECURITYFS
   6        default n
   7        help
   8          SafeSetID is an LSM module that gates the setid family of syscalls to
   9          restrict UID/GID transitions from a given UID/GID to only those
  10          approved by a system-wide whitelist. These restrictions also prohibit
  11          the given UIDs/GIDs from obtaining auxiliary privileges associated
  12          with CAP_SET{U/G}ID, such as allowing a user to set up user namespace
  13          UID mappings.
  14
  15          If you are unsure how to answer this question, answer N.
  16