162306a36Sopenharmony_ciconfig SECURITY_LOCKDOWN_LSM 262306a36Sopenharmony_ci bool "Basic module for enforcing kernel lockdown" 362306a36Sopenharmony_ci depends on SECURITY 462306a36Sopenharmony_ci select MODULE_SIG if MODULES 562306a36Sopenharmony_ci help 662306a36Sopenharmony_ci Build support for an LSM that enforces a coarse kernel lockdown 762306a36Sopenharmony_ci behaviour. 862306a36Sopenharmony_ci 962306a36Sopenharmony_ciconfig SECURITY_LOCKDOWN_LSM_EARLY 1062306a36Sopenharmony_ci bool "Enable lockdown LSM early in init" 1162306a36Sopenharmony_ci depends on SECURITY_LOCKDOWN_LSM 1262306a36Sopenharmony_ci help 1362306a36Sopenharmony_ci Enable the lockdown LSM early in boot. This is necessary in order 1462306a36Sopenharmony_ci to ensure that lockdown enforcement can be carried out on kernel 1562306a36Sopenharmony_ci boot parameters that are otherwise parsed before the security 1662306a36Sopenharmony_ci subsystem is fully initialised. If enabled, lockdown will 1762306a36Sopenharmony_ci unconditionally be called before any other LSMs. 1862306a36Sopenharmony_ci 1962306a36Sopenharmony_cichoice 2062306a36Sopenharmony_ci prompt "Kernel default lockdown mode" 2162306a36Sopenharmony_ci default LOCK_DOWN_KERNEL_FORCE_NONE 2262306a36Sopenharmony_ci depends on SECURITY_LOCKDOWN_LSM 2362306a36Sopenharmony_ci help 2462306a36Sopenharmony_ci The kernel can be configured to default to differing levels of 2562306a36Sopenharmony_ci lockdown. 2662306a36Sopenharmony_ci 2762306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_NONE 2862306a36Sopenharmony_ci bool "None" 2962306a36Sopenharmony_ci help 3062306a36Sopenharmony_ci No lockdown functionality is enabled by default. Lockdown may be 3162306a36Sopenharmony_ci enabled via the kernel commandline or /sys/kernel/security/lockdown. 3262306a36Sopenharmony_ci 3362306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_INTEGRITY 3462306a36Sopenharmony_ci bool "Integrity" 3562306a36Sopenharmony_ci help 3662306a36Sopenharmony_ci The kernel runs in integrity mode by default. Features that allow 3762306a36Sopenharmony_ci the kernel to be modified at runtime are disabled. 3862306a36Sopenharmony_ci 3962306a36Sopenharmony_ciconfig LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY 4062306a36Sopenharmony_ci bool "Confidentiality" 4162306a36Sopenharmony_ci help 4262306a36Sopenharmony_ci The kernel runs in confidentiality mode by default. Features that 4362306a36Sopenharmony_ci allow the kernel to be modified at runtime or that permit userland 4462306a36Sopenharmony_ci code to read confidential material held inside the kernel are 4562306a36Sopenharmony_ci disabled. 4662306a36Sopenharmony_ci 4762306a36Sopenharmony_ciendchoice 48