From 28212bbd55c451374ddc2e4de59cdb0128fc9e46 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 23 Aug 2020 21:45:52 -0500 Subject: [PATCH] kernel: add options needed for SELinux This adds a number of options to config/Config-kernel.in so that packages related to SELinux support can enable the appropriate Linux kernel support. Signed-off-by: Thomas Petazzoni [rebase; add ext4, F2FS, UBIFS, and JFFS2 support; add commit message] Signed-off-by: W. Michael Petullo --- config/Config-kernel.in | 55 ++++++++++++++++++++++++++++++++ target/linux/generic/config-4.14 | 25 +++++++++++++++ target/linux/generic/config-4.19 | 25 +++++++++++++++ target/linux/generic/config-4.9 | 25 +++++++++++++++ 4 files changed, 130 insertions(+) diff --git a/config/Config-kernel.in b/config/Config-kernel.in index e0d853a050..494396b960 100644 --- a/config/Config-kernel.in +++ b/config/Config-kernel.in @@ -889,6 +889,9 @@ config KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE default 2 if (SMALL_FLASH && !LOW_MEMORY_FOOTPRINT) default 3 +config KERNEL_SQUASHFS_XATTR + bool "Squashfs XATTR support" + # # compile optimiziation setting # @@ -910,3 +913,55 @@ config KERNEL_CC_OPTIMIZE_FOR_SIZE your compiler resulting in a smaller kernel. endchoice + +config KERNEL_AUDIT + bool "Auditing support" + +config KERNEL_SECURITY + bool "Enable different security models" + +config KERNEL_SECURITY_NETWORK + bool "Socket and Networking Security Hooks" + select KERNEL_SECURITY + +config KERNEL_SECURITY_SELINUX + bool "NSA SELinux Support" + select KERNEL_SECURITY_NETWORK + select KERNEL_AUDIT + +config KERNEL_SECURITY_SELINUX_BOOTPARAM + bool "NSA SELinux boot parameter" + depends on KERNEL_SECURITY_SELINUX + +config KERNEL_SECURITY_SELINUX_DISABLE + bool "NSA SELinux runtime disable" + depends on KERNEL_SECURITY_SELINUX + +config KERNEL_SECURITY_SELINUX_DEVELOP + bool "NSA SELinux Development Support" + depends on KERNEL_SECURITY_SELINUX + +choice + prompt "First legacy 'major LSM' to be initialized" + depends on KERNEL_SECURITY_SELINUX + default KERNEL_DEFAULT_SECURITY_SELINUX + + config KERNEL_DEFAULT_SECURITY_SELINUX + bool "SELinux" + + config KERNEL_DEFAULT_SECURITY_DAC + bool "Unix Discretionary Access Controls" + +endchoice + +config KERNEL_EXT4_FS_SECURITY + bool "Ext4 Security Labels" + +config KERNEL_F2FS_FS_SECURITY + bool "F2FS Security Labels" + +config KERNEL_UBIFS_FS_SECURITY + bool "UBIFS Security Labels" + +config KERNEL_JFFS2_FS_SECURITY + bool "JFFS2 Security Labels" diff --git a/target/linux/generic/config-4.14 b/target/linux/generic/config-4.14 index ab5a34994f..396a49f015 100644 --- a/target/linux/generic/config-4.14 +++ b/target/linux/generic/config-4.14 @@ -1118,6 +1118,7 @@ CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_SECURITY="" CONFIG_DEFAULT_SECURITY_DAC=y +# CONFIG_DEFAULT_SECURITY_SELINUX is not set CONFIG_DEFAULT_TCP_CONG="cubic" CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" # CONFIG_DELL_LAPTOP is not set @@ -1363,6 +1364,7 @@ CONFIG_EXTRA_TARGETS="" # CONFIG_F2FS_IO_TRACE is not set # CONFIG_FAIR_GROUP_SCHED is not set # CONFIG_FANOTIFY is not set +# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_FAT_DEFAULT_UTF8 is not set @@ -1504,6 +1506,24 @@ CONFIG_FLAT_NODE_MEM_MAP=y # CONFIG_FORCEDETH is not set CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_FORTIFY_SOURCE=y +# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set +# CONFIG_SECURITY_SELINUX_DISABLE is not set +# CONFIG_SECURITY_SELINUX_DEVELOP is not set +# CONFIG_SECURITY_SELINUX_AVC_STATS is not set +CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0 +# CONFIG_SECURITY_SMACK is not set +# CONFIG_SECURITY_TOMOYO is not set +# CONFIG_SECURITY_APPARMOR is not set +# CONFIG_SECURITY_LOADPIN is not set +# CONFIG_SECURITY_YAMA is not set +# CONFIG_SECURITY_SAFESETID is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set +# CONFIG_INTEGRITY is not set +# CONFIG_INTEGRITY_SIGNATURE is not set +# CONFIG_INTEGRITY_AUDIT is not set +# CONFIG_IMA is not set +# CONFIG_EVM is not set +# CONFIG_LSM is not set # CONFIG_FPGA is not set # CONFIG_FRAMEBUFFER_CONSOLE is not set # CONFIG_FRAME_POINTER is not set @@ -3055,6 +3075,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set # CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set # CONFIG_NETFILTER_XT_TARGET_TEE is not set @@ -3066,6 +3087,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETROM is not set CONFIG_NETWORK_FILESYSTEMS=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set +# CONFIG_NETLABEL is not set # CONFIG_NETWORK_SECMARK is not set # CONFIG_NETXEN_NIC is not set # CONFIG_NET_9P is not set @@ -3292,6 +3314,7 @@ CONFIG_NFS_V3=y CONFIG_NF_CONNTRACK_PROCFS=y # CONFIG_NF_CONNTRACK_PROC_COMPAT is not set # CONFIG_NF_CONNTRACK_SANE is not set +# CONFIG_NF_CONNTRACK_SECMARK is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_SNMP is not set # CONFIG_NF_CONNTRACK_TFTP is not set @@ -4126,6 +4149,8 @@ CONFIG_SCSI_PROC_FS=y CONFIG_SECTION_MISMATCH_WARN_ONLY=y # CONFIG_SECURITY is not set # CONFIG_SECURITYFS is not set +# CONFIG_SECURITY_PATH is not set +CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_SELECT_MEMORY_MODEL=y # CONFIG_SENSORS_ABITUGURU is not set diff --git a/target/linux/generic/config-4.19 b/target/linux/generic/config-4.19 index 3fd2c3ec38..b67dd7adc2 100644 --- a/target/linux/generic/config-4.19 +++ b/target/linux/generic/config-4.19 @@ -1158,6 +1158,7 @@ CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_SECURITY="" CONFIG_DEFAULT_SECURITY_DAC=y +# CONFIG_DEFAULT_SECURITY_SELINUX is not set CONFIG_DEFAULT_TCP_CONG="cubic" CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set @@ -1431,6 +1432,7 @@ CONFIG_EXTRA_TARGETS="" # CONFIG_FAILOVER is not set # CONFIG_FAIR_GROUP_SCHED is not set # CONFIG_FANOTIFY is not set +# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_FAT_DEFAULT_UTF8 is not set @@ -1572,6 +1574,24 @@ CONFIG_FLAT_NODE_MEM_MAP=y # CONFIG_FORCEDETH is not set CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_FORTIFY_SOURCE=y +# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set +# CONFIG_SECURITY_SELINUX_DISABLE is not set +# CONFIG_SECURITY_SELINUX_DEVELOP is not set +# CONFIG_SECURITY_SELINUX_AVC_STATS is not set +CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0 +# CONFIG_SECURITY_SMACK is not set +# CONFIG_SECURITY_TOMOYO is not set +# CONFIG_SECURITY_APPARMOR is not set +# CONFIG_SECURITY_LOADPIN is not set +# CONFIG_SECURITY_YAMA is not set +# CONFIG_SECURITY_SAFESETID is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set +# CONFIG_INTEGRITY is not set +# CONFIG_INTEGRITY_SIGNATURE is not set +# CONFIG_INTEGRITY_AUDIT is not set +# CONFIG_IMA is not set +# CONFIG_EVM is not set +# CONFIG_LSM is not set # CONFIG_FPGA is not set # CONFIG_FRAMEBUFFER_CONSOLE is not set # CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set @@ -3187,6 +3207,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set # CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set # CONFIG_NETFILTER_XT_TARGET_TEE is not set @@ -3198,6 +3219,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETROM is not set CONFIG_NETWORK_FILESYSTEMS=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set +# CONFIG_NETLABEL is not set # CONFIG_NETWORK_SECMARK is not set # CONFIG_NETXEN_NIC is not set # CONFIG_NET_9P is not set @@ -3447,6 +3469,7 @@ CONFIG_NFS_V3=y CONFIG_NF_CONNTRACK_PROCFS=y # CONFIG_NF_CONNTRACK_PROC_COMPAT is not set # CONFIG_NF_CONNTRACK_SANE is not set +# CONFIG_NF_CONNTRACK_SECMARK is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_SNMP is not set # CONFIG_NF_CONNTRACK_TFTP is not set @@ -4321,6 +4344,8 @@ CONFIG_SCSI_PROC_FS=y CONFIG_SECTION_MISMATCH_WARN_ONLY=y # CONFIG_SECURITY is not set # CONFIG_SECURITYFS is not set +# CONFIG_SECURITY_PATH is not set +CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_SELECT_MEMORY_MODEL=y # CONFIG_SENSORS_ABITUGURU is not set diff --git a/target/linux/generic/config-4.9 b/target/linux/generic/config-4.9 index e509fd7104..79fab3fe16 100644 --- a/target/linux/generic/config-4.9 +++ b/target/linux/generic/config-4.9 @@ -1008,6 +1008,7 @@ CONFIG_DEFAULT_IOSCHED="deadline" CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 # CONFIG_DEFAULT_NOOP is not set # CONFIG_DEFAULT_RENO is not set +# CONFIG_DEFAULT_SECURITY_SELINUX is not set CONFIG_DEFAULT_SECURITY="" CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_DEFAULT_TCP_CONG="cubic" @@ -1212,6 +1213,7 @@ CONFIG_EXTRA_TARGETS="" # CONFIG_F2FS_IO_TRACE is not set # CONFIG_FAIR_GROUP_SCHED is not set # CONFIG_FANOTIFY is not set +# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_FAT_DEFAULT_UTF8 is not set @@ -1318,6 +1320,24 @@ CONFIG_FLAT_NODE_MEM_MAP=y # CONFIG_FMC is not set # CONFIG_FORCEDETH is not set CONFIG_FORCE_MAX_ZONEORDER=11 +# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set +# CONFIG_SECURITY_SELINUX_DISABLE is not set +# CONFIG_SECURITY_SELINUX_DEVELOP is not set +# CONFIG_SECURITY_SELINUX_AVC_STATS is not set +CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0 +# CONFIG_SECURITY_SMACK is not set +# CONFIG_SECURITY_TOMOYO is not set +# CONFIG_SECURITY_APPARMOR is not set +# CONFIG_SECURITY_LOADPIN is not set +# CONFIG_SECURITY_YAMA is not set +# CONFIG_SECURITY_SAFESETID is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set +# CONFIG_INTEGRITY is not set +# CONFIG_INTEGRITY_SIGNATURE is not set +# CONFIG_INTEGRITY_AUDIT is not set +# CONFIG_IMA is not set +# CONFIG_EVM is not set +# CONFIG_LSM is not set # CONFIG_FPGA is not set # CONFIG_FRAMEBUFFER_CONSOLE is not set # CONFIG_FRAME_POINTER is not set @@ -2766,6 +2786,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set # CONFIG_NETFILTER_XT_TARGET_RATEEST is not set # CONFIG_NETFILTER_XT_TARGET_REDIRECT is not set +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set # CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set # CONFIG_NETFILTER_XT_TARGET_TEE is not set @@ -2777,6 +2798,7 @@ CONFIG_NETDEVICES=y # CONFIG_NETROM is not set CONFIG_NETWORK_FILESYSTEMS=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set +# CONFIG_NETLABEL is not set # CONFIG_NETWORK_SECMARK is not set # CONFIG_NETXEN_NIC is not set # CONFIG_NET_9P is not set @@ -2984,6 +3006,7 @@ CONFIG_NFS_V3=y CONFIG_NF_CONNTRACK_PROCFS=y # CONFIG_NF_CONNTRACK_PROC_COMPAT is not set # CONFIG_NF_CONNTRACK_SANE is not set +# CONFIG_NF_CONNTRACK_SECMARK is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_SNMP is not set # CONFIG_NF_CONNTRACK_TFTP is not set @@ -3769,6 +3792,8 @@ CONFIG_SCSI_PROC_FS=y CONFIG_SECTION_MISMATCH_WARN_ONLY=y # CONFIG_SECURITY is not set # CONFIG_SECURITYFS is not set +# CONFIG_SECURITY_PATH is not set +CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_SELECT_MEMORY_MODEL=y # CONFIG_SENSORS_ABITUGURU is not set