Merge tag 'apparmor-pr-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git...

[sfrench/cifs-2.6.git] / security / apparmor / Kconfig

diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
index 348ed6cfa08a02f2d0aad87b2c552cb46913542f..cb3496e00d8a6ab9d425d233c2a9bb3bfad631b1 100644 (file)
--- a/security/apparmor/Kconfig
+++ b/security/apparmor/Kconfig
@@ -6,8 +6,6 @@ config SECURITY_APPARMOR
        select SECURITY_PATH
        select SECURITYFS
        select SECURITY_NETWORK
-       select ZLIB_INFLATE
-       select ZLIB_DEFLATE
        default n
        help
          This enables the AppArmor security module.
@@ -17,29 +15,6 @@ config SECURITY_APPARMOR
 
          If you are unsure how to answer this question, answer N.
 
-config SECURITY_APPARMOR_HASH
-       bool "Enable introspection of sha1 hashes for loaded profiles"
-       depends on SECURITY_APPARMOR
-       select CRYPTO
-       select CRYPTO_SHA1
-       default y
-       help
-         This option selects whether introspection of loaded policy
-         is available to userspace via the apparmor filesystem.
-
-config SECURITY_APPARMOR_HASH_DEFAULT
-       bool "Enable policy hash introspection by default"
-       depends on SECURITY_APPARMOR_HASH
-       default y
-       help
-         This option selects whether sha1 hashing of loaded policy
-        is enabled by default. The generation of sha1 hashes for
-        loaded policy provide system administrators a quick way
-        to verify that policy in the kernel matches what is expected,
-        however it can slow down policy load on some devices. In
-        these cases policy hashing can be disabled by default and
-        enabled only if needed.
-
 config SECURITY_APPARMOR_DEBUG
        bool "Build AppArmor with debug code"
        depends on SECURITY_APPARMOR
@@ -69,6 +44,67 @@ config SECURITY_APPARMOR_DEBUG_MESSAGES
          When enabled, various debug messages will be logged to
          the kernel message buffer.
 
+config SECURITY_APPARMOR_INTROSPECT_POLICY
+       bool "Allow loaded policy to be introspected"
+       depends on SECURITY_APPARMOR
+       default y
+       help
+         This option selects whether introspection of loaded policy
+         is available to userspace via the apparmor filesystem. This
+         adds to kernel memory usage. It is required for introspection
+         of loaded policy, and check point and restore support. It
+         can be disabled for embedded systems where reducing memory and
+         cpu is paramount.
+
+config SECURITY_APPARMOR_HASH
+       bool "Enable introspection of sha1 hashes for loaded profiles"
+       depends on SECURITY_APPARMOR_INTROSPECT_POLICY
+       select CRYPTO
+       select CRYPTO_SHA1
+       default y
+       help
+         This option selects whether introspection of loaded policy
+         hashes is available to userspace via the apparmor
+         filesystem. This option provides a light weight means of
+         checking loaded policy.  This option adds to policy load
+         time and can be disabled for small embedded systems.
+
+config SECURITY_APPARMOR_HASH_DEFAULT
+       bool "Enable policy hash introspection by default"
+       depends on SECURITY_APPARMOR_HASH
+       default y
+       help
+         This option selects whether sha1 hashing of loaded policy
+        is enabled by default. The generation of sha1 hashes for
+        loaded policy provide system administrators a quick way
+        to verify that policy in the kernel matches what is expected,
+        however it can slow down policy load on some devices. In
+        these cases policy hashing can be disabled by default and
+        enabled only if needed.
+
+config SECURITY_APPARMOR_EXPORT_BINARY
+       bool "Allow exporting the raw binary policy"
+       depends on SECURITY_APPARMOR_INTROSPECT_POLICY
+       select ZLIB_INFLATE
+       select ZLIB_DEFLATE
+       default y
+       help
+         This option allows reading back binary policy as it was loaded.
+         It increases the amount of kernel memory needed by policy and
+         also increases policy load time. This option is required for
+         checkpoint and restore support, and debugging of loaded policy.
+
+config SECURITY_APPARMOR_PARANOID_LOAD
+       bool "Perform full verification of loaded policy"
+       depends on SECURITY_APPARMOR
+       default y
+       help
+         This options allows controlling whether apparmor does a full
+         verification of loaded policy. This should not be disabled
+         except for embedded systems where the image is read only,
+         includes policy, and has some form of integrity check.
+         Disabling the check will speed up policy loads.
+
 config SECURITY_APPARMOR_KUNIT_TEST
        bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS
        depends on KUNIT=y && SECURITY_APPARMOR