| config SECURITY_LOCKDOWN_LSM | |
| bool "Basic module for enforcing kernel lockdown" | |
| depends on SECURITY | |
| select MODULE_SIG if MODULES | |
| help | |
| Build support for an LSM that enforces a coarse kernel lockdown | |
| behaviour. | |
| config SECURITY_LOCKDOWN_LSM_EARLY | |
| bool "Enable lockdown LSM early in init" | |
| depends on SECURITY_LOCKDOWN_LSM | |
| help | |
| Enable the lockdown LSM early in boot. This is necessary in order | |
| to ensure that lockdown enforcement can be carried out on kernel | |
| boot parameters that are otherwise parsed before the security | |
| subsystem is fully initialised. If enabled, lockdown will | |
| unconditionally be called before any other LSMs. | |
| choice | |
| prompt "Kernel default lockdown mode" | |
| default LOCK_DOWN_KERNEL_FORCE_NONE | |
| depends on SECURITY_LOCKDOWN_LSM | |
| help | |
| The kernel can be configured to default to differing levels of | |
| lockdown. | |
| config LOCK_DOWN_KERNEL_FORCE_NONE | |
| bool "None" | |
| help | |
| No lockdown functionality is enabled by default. Lockdown may be | |
| enabled via the kernel commandline or /sys/kernel/security/lockdown. | |
| config LOCK_DOWN_KERNEL_FORCE_INTEGRITY | |
| bool "Integrity" | |
| help | |
| The kernel runs in integrity mode by default. Features that allow | |
| the kernel to be modified at runtime are disabled. | |
| config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY | |
| bool "Confidentiality" | |
| help | |
| The kernel runs in confidentiality mode by default. Features that | |
| allow the kernel to be modified at runtime or that permit userland | |
| code to read confidential material held inside the kernel are | |
| disabled. | |
| endchoice |