| # SPDX-License-Identifier: GPL-2.0-only | |
| config SECURITY_APPARMOR | |
| bool "AppArmor support" | |
| depends on SECURITY && NET | |
| select AUDIT | |
| select SECURITY_PATH | |
| select SECURITYFS | |
| select SECURITY_NETWORK | |
| default n | |
| help | |
| This enables the AppArmor security module. | |
| Required userspace tools (if they are not included in your | |
| distribution) and further information may be found at | |
| http://apparmor.wiki.kernel.org | |
| If you are unsure how to answer this question, answer N. | |
| config SECURITY_APPARMOR_HASH | |
| bool "Enable introspection of sha1 hashes for loaded profiles" | |
| depends on SECURITY_APPARMOR | |
| select CRYPTO | |
| select CRYPTO_SHA1 | |
| default y | |
| help | |
| This option selects whether introspection of loaded policy | |
| is available to userspace via the apparmor filesystem. | |
| config SECURITY_APPARMOR_HASH_DEFAULT | |
| bool "Enable policy hash introspection by default" | |
| depends on SECURITY_APPARMOR_HASH | |
| default y | |
| help | |
| This option selects whether sha1 hashing of loaded policy | |
| is enabled by default. The generation of sha1 hashes for | |
| loaded policy provide system administrators a quick way | |
| to verify that policy in the kernel matches what is expected, | |
| however it can slow down policy load on some devices. In | |
| these cases policy hashing can be disabled by default and | |
| enabled only if needed. | |
| config SECURITY_APPARMOR_DEBUG | |
| bool "Build AppArmor with debug code" | |
| depends on SECURITY_APPARMOR | |
| default n | |
| help | |
| Build apparmor with debugging logic in apparmor. Not all | |
| debugging logic will necessarily be enabled. A submenu will | |
| provide fine grained control of the debug options that are | |
| available. | |
| config SECURITY_APPARMOR_DEBUG_ASSERTS | |
| bool "Build AppArmor with debugging asserts" | |
| depends on SECURITY_APPARMOR_DEBUG | |
| default y | |
| help | |
| Enable code assertions made with AA_BUG. These are primarily | |
| function entry preconditions but also exist at other key | |
| points. If the assert is triggered it will trigger a WARN | |
| message. | |
| config SECURITY_APPARMOR_DEBUG_MESSAGES | |
| bool "Debug messages enabled by default" | |
| depends on SECURITY_APPARMOR_DEBUG | |
| default n | |
| help | |
| Set the default value of the apparmor.debug kernel parameter. | |
| When enabled, various debug messages will be logged to | |
| the kernel message buffer. |