162306a36Sopenharmony_ciconfig SECURITY_LOCKDOWN_LSM
262306a36Sopenharmony_ci	bool "Basic module for enforcing kernel lockdown"
362306a36Sopenharmony_ci	depends on SECURITY
462306a36Sopenharmony_ci	select MODULE_SIG if MODULES
562306a36Sopenharmony_ci	help
662306a36Sopenharmony_ci	  Build support for an LSM that enforces a coarse kernel lockdown
762306a36Sopenharmony_ci	  behaviour.
862306a36Sopenharmony_ci
962306a36Sopenharmony_ciconfig SECURITY_LOCKDOWN_LSM_EARLY
1062306a36Sopenharmony_ci	bool "Enable lockdown LSM early in init"
1162306a36Sopenharmony_ci	depends on SECURITY_LOCKDOWN_LSM
1262306a36Sopenharmony_ci	help
1362306a36Sopenharmony_ci	  Enable the lockdown LSM early in boot. This is necessary in order
1462306a36Sopenharmony_ci	  to ensure that lockdown enforcement can be carried out on kernel
1562306a36Sopenharmony_ci	  boot parameters that are otherwise parsed before the security
1662306a36Sopenharmony_ci	  subsystem is fully initialised. If enabled, lockdown will
1762306a36Sopenharmony_ci	  unconditionally be called before any other LSMs.
1862306a36Sopenharmony_ci
1962306a36Sopenharmony_cichoice
2062306a36Sopenharmony_ci	prompt "Kernel default lockdown mode"
2162306a36Sopenharmony_ci	default LOCK_DOWN_KERNEL_FORCE_NONE
2262306a36Sopenharmony_ci	depends on SECURITY_LOCKDOWN_LSM
2362306a36Sopenharmony_ci	help
2462306a36Sopenharmony_ci	  The kernel can be configured to default to differing levels of
2562306a36Sopenharmony_ci	  lockdown.
2662306a36Sopenharmony_ci
2762306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_NONE
2862306a36Sopenharmony_ci	bool "None"
2962306a36Sopenharmony_ci	help
3062306a36Sopenharmony_ci	  No lockdown functionality is enabled by default. Lockdown may be
3162306a36Sopenharmony_ci	  enabled via the kernel commandline or /sys/kernel/security/lockdown.
3262306a36Sopenharmony_ci
3362306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_INTEGRITY
3462306a36Sopenharmony_ci	bool "Integrity"
3562306a36Sopenharmony_ci	help
3662306a36Sopenharmony_ci	 The kernel runs in integrity mode by default. Features that allow
3762306a36Sopenharmony_ci	 the kernel to be modified at runtime are disabled.
3862306a36Sopenharmony_ci
3962306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
4062306a36Sopenharmony_ci	bool "Confidentiality"
4162306a36Sopenharmony_ci	help
4262306a36Sopenharmony_ci	 The kernel runs in confidentiality mode by default. Features that
4362306a36Sopenharmony_ci	 allow the kernel to be modified at runtime or that permit userland
4462306a36Sopenharmony_ci	 code to read confidential material held inside the kernel are
4562306a36Sopenharmony_ci	 disabled.
4662306a36Sopenharmony_ci
4762306a36Sopenharmony_ciendchoice
48