diff options
| -rw-r--r-- | init/Kconfig | 116 |
1 files changed, 60 insertions, 56 deletions
diff --git a/init/Kconfig b/init/Kconfig index c40d0fb044ef..2c5aa3407d6b 100644 --- a/init/Kconfig +++ b/init/Kconfig | |||
| @@ -267,6 +267,65 @@ config POSIX_MQUEUE_SYSCTL | |||
| 267 | depends on SYSCTL | 267 | depends on SYSCTL |
| 268 | default y | 268 | default y |
| 269 | 269 | ||
| 270 | config FHANDLE | ||
| 271 | bool "open by fhandle syscalls" | ||
| 272 | select EXPORTFS | ||
| 273 | help | ||
| 274 | If you say Y here, a user level program will be able to map | ||
| 275 | file names to handle and then later use the handle for | ||
| 276 | different file system operations. This is useful in implementing | ||
| 277 | userspace file servers, which now track files using handles instead | ||
| 278 | of names. The handle would remain the same even if file names | ||
| 279 | get renamed. Enables open_by_handle_at(2) and name_to_handle_at(2) | ||
| 280 | syscalls. | ||
| 281 | |||
| 282 | config AUDIT | ||
| 283 | bool "Auditing support" | ||
| 284 | depends on NET | ||
| 285 | help | ||
| 286 | Enable auditing infrastructure that can be used with another | ||
| 287 | kernel subsystem, such as SELinux (which requires this for | ||
| 288 | logging of avc messages output). Does not do system-call | ||
| 289 | auditing without CONFIG_AUDITSYSCALL. | ||
| 290 | |||
| 291 | config AUDITSYSCALL | ||
| 292 | bool "Enable system-call auditing support" | ||
| 293 | depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || (ARM && AEABI && !OABI_COMPAT)) | ||
| 294 | default y if SECURITY_SELINUX | ||
| 295 | help | ||
| 296 | Enable low-overhead system-call auditing infrastructure that | ||
| 297 | can be used independently or with another kernel subsystem, | ||
| 298 | such as SELinux. | ||
| 299 | |||
| 300 | config AUDIT_WATCH | ||
| 301 | def_bool y | ||
| 302 | depends on AUDITSYSCALL | ||
| 303 | select FSNOTIFY | ||
| 304 | |||
| 305 | config AUDIT_TREE | ||
| 306 | def_bool y | ||
| 307 | depends on AUDITSYSCALL | ||
| 308 | select FSNOTIFY | ||
| 309 | |||
| 310 | config AUDIT_LOGINUID_IMMUTABLE | ||
| 311 | bool "Make audit loginuid immutable" | ||
| 312 | depends on AUDIT | ||
| 313 | help | ||
| 314 | The config option toggles if a task setting its loginuid requires | ||
| 315 | CAP_SYS_AUDITCONTROL or if that task should require no special permissions | ||
| 316 | but should instead only allow setting its loginuid if it was never | ||
| 317 | previously set. On systems which use systemd or a similar central | ||
| 318 | process to restart login services this should be set to true. On older | ||
| 319 | systems in which an admin would typically have to directly stop and | ||
| 320 | start processes this should be set to false. Setting this to true allows | ||
| 321 | one to drop potentially dangerous capabilites from the login tasks, | ||
| 322 | but may not be backwards compatible with older init systems. | ||
| 323 | |||
| 324 | source "kernel/irq/Kconfig" | ||
| 325 | source "kernel/time/Kconfig" | ||
| 326 | |||
| 327 | menu "CPU/Task time and stats accounting" | ||
| 328 | |||
| 270 | config VIRT_CPU_ACCOUNTING | 329 | config VIRT_CPU_ACCOUNTING |
| 271 | bool "Deterministic task and CPU time accounting" | 330 | bool "Deterministic task and CPU time accounting" |
| 272 | depends on HAVE_VIRT_CPU_ACCOUNTING | 331 | depends on HAVE_VIRT_CPU_ACCOUNTING |
| @@ -305,18 +364,6 @@ config BSD_PROCESS_ACCT_V3 | |||
| 305 | for processing it. A preliminary version of these tools is available | 364 | for processing it. A preliminary version of these tools is available |
| 306 | at <http://www.gnu.org/software/acct/>. | 365 | at <http://www.gnu.org/software/acct/>. |
| 307 | 366 | ||
| 308 | config FHANDLE | ||
| 309 | bool "open by fhandle syscalls" | ||
| 310 | select EXPORTFS | ||
| 311 | help | ||
| 312 | If you say Y here, a user level program will be able to map | ||
| 313 | file names to handle and then later use the handle for | ||
| 314 | different file system operations. This is useful in implementing | ||
| 315 | userspace file servers, which now track files using handles instead | ||
| 316 | of names. The handle would remain the same even if file names | ||
| 317 | get renamed. Enables open_by_handle_at(2) and name_to_handle_at(2) | ||
| 318 | syscalls. | ||
| 319 | |||
| 320 | config TASKSTATS | 367 | config TASKSTATS |
| 321 | bool "Export task/process statistics through netlink (EXPERIMENTAL)" | 368 | bool "Export task/process statistics through netlink (EXPERIMENTAL)" |
| 322 | depends on NET | 369 | depends on NET |
| @@ -359,50 +406,7 @@ config TASK_IO_ACCOUNTING | |||
| 359 | 406 | ||
| 360 | Say N if unsure. | 407 | Say N if unsure. |
| 361 | 408 | ||
| 362 | config AUDIT | 409 | endmenu # "CPU/Task time and stats accounting" |
| 363 | bool "Auditing support" | ||
| 364 | depends on NET | ||
| 365 | help | ||
| 366 | Enable auditing infrastructure that can be used with another | ||
| 367 | kernel subsystem, such as SELinux (which requires this for | ||
| 368 | logging of avc messages output). Does not do system-call | ||
| 369 | auditing without CONFIG_AUDITSYSCALL. | ||
| 370 | |||
| 371 | config AUDITSYSCALL | ||
| 372 | bool "Enable system-call auditing support" | ||
| 373 | depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || (ARM && AEABI && !OABI_COMPAT)) | ||
| 374 | default y if SECURITY_SELINUX | ||
| 375 | help | ||
| 376 | Enable low-overhead system-call auditing infrastructure that | ||
| 377 | can be used independently or with another kernel subsystem, | ||
| 378 | such as SELinux. | ||
| 379 | |||
| 380 | config AUDIT_WATCH | ||
| 381 | def_bool y | ||
| 382 | depends on AUDITSYSCALL | ||
| 383 | select FSNOTIFY | ||
| 384 | |||
| 385 | config AUDIT_TREE | ||
| 386 | def_bool y | ||
| 387 | depends on AUDITSYSCALL | ||
| 388 | select FSNOTIFY | ||
| 389 | |||
| 390 | config AUDIT_LOGINUID_IMMUTABLE | ||
| 391 | bool "Make audit loginuid immutable" | ||
| 392 | depends on AUDIT | ||
| 393 | help | ||
| 394 | The config option toggles if a task setting its loginuid requires | ||
| 395 | CAP_SYS_AUDITCONTROL or if that task should require no special permissions | ||
| 396 | but should instead only allow setting its loginuid if it was never | ||
| 397 | previously set. On systems which use systemd or a similar central | ||
| 398 | process to restart login services this should be set to true. On older | ||
| 399 | systems in which an admin would typically have to directly stop and | ||
| 400 | start processes this should be set to false. Setting this to true allows | ||
| 401 | one to drop potentially dangerous capabilites from the login tasks, | ||
| 402 | but may not be backwards compatible with older init systems. | ||
| 403 | |||
| 404 | source "kernel/irq/Kconfig" | ||
| 405 | source "kernel/time/Kconfig" | ||
| 406 | 410 | ||
| 407 | menu "RCU Subsystem" | 411 | menu "RCU Subsystem" |
| 408 | 412 | ||
