1config SECURITY_APPARMOR
 2	bool "AppArmor support"
 3	depends on SECURITY && NET
 4	select AUDIT
 5	select SECURITY_PATH
 6	select SECURITYFS
 7	select SECURITY_NETWORK
 8	default n
 9	help
10	  This enables the AppArmor security module.
11	  Required userspace tools (if they are not included in your
12	  distribution) and further information may be found at
13	  http://apparmor.wiki.kernel.org
14
15	  If you are unsure how to answer this question, answer N.
16
17config SECURITY_APPARMOR_BOOTPARAM_VALUE
18	int "AppArmor boot parameter default value"
19	depends on SECURITY_APPARMOR
20	range 0 1
21	default 1
22	help
23	  This option sets the default value for the kernel parameter
24	  'apparmor', which allows AppArmor to be enabled or disabled
25          at boot.  If this option is set to 0 (zero), the AppArmor
26	  kernel parameter will default to 0, disabling AppArmor at
27	  boot.  If this option is set to 1 (one), the AppArmor
28	  kernel parameter will default to 1, enabling AppArmor at
29	  boot.
30
31	  If you are unsure how to answer this question, answer 1.
32
33config SECURITY_APPARMOR_HASH
34	bool "Enable introspection of sha1 hashes for loaded profiles"
35	depends on SECURITY_APPARMOR
36	select CRYPTO
37	select CRYPTO_SHA1
38	default y
39	help
40	  This option selects whether introspection of loaded policy
41	  is available to userspace via the apparmor filesystem.
42
43config SECURITY_APPARMOR_HASH_DEFAULT
44       bool "Enable policy hash introspection by default"
45       depends on SECURITY_APPARMOR_HASH
46       default y
47       help
48         This option selects whether sha1 hashing of loaded policy
49	 is enabled by default. The generation of sha1 hashes for
50	 loaded policy provide system administrators a quick way
51	 to verify that policy in the kernel matches what is expected,
52	 however it can slow down policy load on some devices. In
53	 these cases policy hashing can be disabled by default and
54	 enabled only if needed.
55
56config SECURITY_APPARMOR_DEBUG
57	bool "Build AppArmor with debug code"
58	depends on SECURITY_APPARMOR
59	default n
60	help
61	  Build apparmor with debugging logic in apparmor. Not all
62	  debugging logic will necessarily be enabled. A submenu will
63	  provide fine grained control of the debug options that are
64	  available.
65
66config SECURITY_APPARMOR_DEBUG_ASSERTS
67	bool "Build AppArmor with debugging asserts"
68	depends on SECURITY_APPARMOR_DEBUG
69	default y
70	help
71	  Enable code assertions made with AA_BUG. These are primarily
72	  function entry preconditions but also exist at other key
73	  points. If the assert is triggered it will trigger a WARN
74	  message.
75
76config SECURITY_APPARMOR_DEBUG_MESSAGES
77	bool "Debug messages enabled by default"
78	depends on SECURITY_APPARMOR_DEBUG
79	default n
80	help
81	  Set the default value of the apparmor.debug kernel parameter.
82	  When enabled, various debug messages will be logged to
83	  the kernel message buffer.

 1# SPDX-License-Identifier: GPL-2.0-only
 2config SECURITY_APPARMOR
 3	bool "AppArmor support"
 4	depends on SECURITY && NET
 5	select AUDIT
 6	select SECURITY_PATH
 7	select SECURITYFS
 8	select SECURITY_NETWORK
 9	default n
10	help
11	  This enables the AppArmor security module.
12	  Required userspace tools (if they are not included in your
13	  distribution) and further information may be found at
14	  http://apparmor.wiki.kernel.org
15
16	  If you are unsure how to answer this question, answer N.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
17
18config SECURITY_APPARMOR_HASH
19	bool "Enable introspection of sha1 hashes for loaded profiles"
20	depends on SECURITY_APPARMOR
21	select CRYPTO
22	select CRYPTO_SHA1
23	default y
24	help
25	  This option selects whether introspection of loaded policy
26	  is available to userspace via the apparmor filesystem.
27
28config SECURITY_APPARMOR_HASH_DEFAULT
29       bool "Enable policy hash introspection by default"
30       depends on SECURITY_APPARMOR_HASH
31       default y
32       help
33         This option selects whether sha1 hashing of loaded policy
34	 is enabled by default. The generation of sha1 hashes for
35	 loaded policy provide system administrators a quick way
36	 to verify that policy in the kernel matches what is expected,
37	 however it can slow down policy load on some devices. In
38	 these cases policy hashing can be disabled by default and
39	 enabled only if needed.
40
41config SECURITY_APPARMOR_DEBUG
42	bool "Build AppArmor with debug code"
43	depends on SECURITY_APPARMOR
44	default n
45	help
46	  Build apparmor with debugging logic in apparmor. Not all
47	  debugging logic will necessarily be enabled. A submenu will
48	  provide fine grained control of the debug options that are
49	  available.
50
51config SECURITY_APPARMOR_DEBUG_ASSERTS
52	bool "Build AppArmor with debugging asserts"
53	depends on SECURITY_APPARMOR_DEBUG
54	default y
55	help
56	  Enable code assertions made with AA_BUG. These are primarily
57	  function entry preconditions but also exist at other key
58	  points. If the assert is triggered it will trigger a WARN
59	  message.
60
61config SECURITY_APPARMOR_DEBUG_MESSAGES
62	bool "Debug messages enabled by default"
63	depends on SECURITY_APPARMOR_DEBUG
64	default n
65	help
66	  Set the default value of the apparmor.debug kernel parameter.
67	  When enabled, various debug messages will be logged to
68	  the kernel message buffer.