diff options
Diffstat (limited to 'init/Kconfig')
| -rw-r--r-- | init/Kconfig | 157 |
1 files changed, 101 insertions, 56 deletions
diff --git a/init/Kconfig b/init/Kconfig index c26b8a1d2b57..3466a6e017b7 100644 --- a/init/Kconfig +++ b/init/Kconfig | |||
| @@ -267,6 +267,106 @@ config POSIX_MQUEUE_SYSCTL | |||
| 267 | depends on SYSCTL | 267 | depends on SYSCTL |
| 268 | default y | 268 | default y |
| 269 | 269 | ||
| 270 | config FHANDLE | ||
| 271 | bool "open by fhandle syscalls" | ||
| 272 | select EXPORTFS | ||
| 273 | help | ||
| 274 | If you say Y here, a user level program will be able to map | ||
| 275 | file names to handle and then later use the handle for | ||
| 276 | different file system operations. This is useful in implementing | ||
| 277 | userspace file servers, which now track files using handles instead | ||
| 278 | of names. The handle would remain the same even if file names | ||
| 279 | get renamed. Enables open_by_handle_at(2) and name_to_handle_at(2) | ||
| 280 | syscalls. | ||
| 281 | |||
| 282 | config AUDIT | ||
| 283 | bool "Auditing support" | ||
| 284 | depends on NET | ||
| 285 | help | ||
| 286 | Enable auditing infrastructure that can be used with another | ||
| 287 | kernel subsystem, such as SELinux (which requires this for | ||
| 288 | logging of avc messages output). Does not do system-call | ||
| 289 | auditing without CONFIG_AUDITSYSCALL. | ||
| 290 | |||
| 291 | config AUDITSYSCALL | ||
| 292 | bool "Enable system-call auditing support" | ||
| 293 | depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || (ARM && AEABI && !OABI_COMPAT)) | ||
| 294 | default y if SECURITY_SELINUX | ||
| 295 | help | ||
| 296 | Enable low-overhead system-call auditing infrastructure that | ||
| 297 | can be used independently or with another kernel subsystem, | ||
| 298 | such as SELinux. | ||
| 299 | |||
| 300 | config AUDIT_WATCH | ||
| 301 | def_bool y | ||
| 302 | depends on AUDITSYSCALL | ||
| 303 | select FSNOTIFY | ||
| 304 | |||
| 305 | config AUDIT_TREE | ||
| 306 | def_bool y | ||
| 307 | depends on AUDITSYSCALL | ||
| 308 | select FSNOTIFY | ||
| 309 | |||
| 310 | config AUDIT_LOGINUID_IMMUTABLE | ||
| 311 | bool "Make audit loginuid immutable" | ||
| 312 | depends on AUDIT | ||
| 313 | help | ||
| 314 | The config option toggles if a task setting its loginuid requires | ||
| 315 | CAP_SYS_AUDITCONTROL or if that task should require no special permissions | ||
| 316 | but should instead only allow setting its loginuid if it was never | ||
| 317 | previously set. On systems which use systemd or a similar central | ||
| 318 | process to restart login services this should be set to true. On older | ||
| 319 | systems in which an admin would typically have to directly stop and | ||
| 320 | start processes this should be set to false. Setting this to true allows | ||
| 321 | one to drop potentially dangerous capabilites from the login tasks, | ||
| 322 | but may not be backwards compatible with older init systems. | ||
| 323 | |||
| 324 | source "kernel/irq/Kconfig" | ||
| 325 | source "kernel/time/Kconfig" | ||
| 326 | |||
| 327 | menu "CPU/Task time and stats accounting" | ||
| 328 | |||
| 329 | choice | ||
| 330 | prompt "Cputime accounting" | ||
| 331 | default TICK_CPU_ACCOUNTING if !PPC64 | ||
| 332 | default VIRT_CPU_ACCOUNTING if PPC64 | ||
| 333 | |||
| 334 | # Kind of a stub config for the pure tick based cputime accounting | ||
| 335 | config TICK_CPU_ACCOUNTING | ||
| 336 | bool "Simple tick based cputime accounting" | ||
| 337 | depends on !S390 | ||
| 338 | help | ||
| 339 | This is the basic tick based cputime accounting that maintains | ||
| 340 | statistics about user, system and idle time spent on per jiffies | ||
| 341 | granularity. | ||
| 342 | |||
| 343 | If unsure, say Y. | ||
| 344 | |||
| 345 | config VIRT_CPU_ACCOUNTING | ||
| 346 | bool "Deterministic task and CPU time accounting" | ||
| 347 | depends on HAVE_VIRT_CPU_ACCOUNTING | ||
| 348 | help | ||
| 349 | Select this option to enable more accurate task and CPU time | ||
| 350 | accounting. This is done by reading a CPU counter on each | ||
| 351 | kernel entry and exit and on transitions within the kernel | ||
| 352 | between system, softirq and hardirq state, so there is a | ||
| 353 | small performance impact. In the case of s390 or IBM POWER > 5, | ||
| 354 | this also enables accounting of stolen time on logically-partitioned | ||
| 355 | systems. | ||
| 356 | |||
| 357 | config IRQ_TIME_ACCOUNTING | ||
| 358 | bool "Fine granularity task level IRQ time accounting" | ||
| 359 | depends on HAVE_IRQ_TIME_ACCOUNTING | ||
| 360 | help | ||
| 361 | Select this option to enable fine granularity task irq time | ||
| 362 | accounting. This is done by reading a timestamp on each | ||
| 363 | transitions between softirq and hardirq state, so there can be a | ||
| 364 | small performance impact. | ||
| 365 | |||
| 366 | If in doubt, say N here. | ||
| 367 | |||
| 368 | endchoice | ||
| 369 | |||
| 270 | config BSD_PROCESS_ACCT | 370 | config BSD_PROCESS_ACCT |
| 271 | bool "BSD Process Accounting" | 371 | bool "BSD Process Accounting" |
| 272 | help | 372 | help |
| @@ -292,18 +392,6 @@ config BSD_PROCESS_ACCT_V3 | |||
| 292 | for processing it. A preliminary version of these tools is available | 392 | for processing it. A preliminary version of these tools is available |
| 293 | at <http://www.gnu.org/software/acct/>. | 393 | at <http://www.gnu.org/software/acct/>. |
| 294 | 394 | ||
| 295 | config FHANDLE | ||
| 296 | bool "open by fhandle syscalls" | ||
| 297 | select EXPORTFS | ||
| 298 | help | ||
| 299 | If you say Y here, a user level program will be able to map | ||
| 300 | file names to handle and then later use the handle for | ||
| 301 | different file system operations. This is useful in implementing | ||
| 302 | userspace file servers, which now track files using handles instead | ||
| 303 | of names. The handle would remain the same even if file names | ||
| 304 | get renamed. Enables open_by_handle_at(2) and name_to_handle_at(2) | ||
| 305 | syscalls. | ||
| 306 | |||
| 307 | config TASKSTATS | 395 | config TASKSTATS |
| 308 | bool "Export task/process statistics through netlink (EXPERIMENTAL)" | 396 | bool "Export task/process statistics through netlink (EXPERIMENTAL)" |
| 309 | depends on NET | 397 | depends on NET |
| @@ -346,50 +434,7 @@ config TASK_IO_ACCOUNTING | |||
| 346 | 434 | ||
| 347 | Say N if unsure. | 435 | Say N if unsure. |
| 348 | 436 | ||
| 349 | config AUDIT | 437 | endmenu # "CPU/Task time and stats accounting" |
| 350 | bool "Auditing support" | ||
| 351 | depends on NET | ||
| 352 | help | ||
| 353 | Enable auditing infrastructure that can be used with another | ||
| 354 | kernel subsystem, such as SELinux (which requires this for | ||
| 355 | logging of avc messages output). Does not do system-call | ||
| 356 | auditing without CONFIG_AUDITSYSCALL. | ||
| 357 | |||
| 358 | config AUDITSYSCALL | ||
| 359 | bool "Enable system-call auditing support" | ||
| 360 | depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || (ARM && AEABI && !OABI_COMPAT)) | ||
| 361 | default y if SECURITY_SELINUX | ||
| 362 | help | ||
| 363 | Enable low-overhead system-call auditing infrastructure that | ||
| 364 | can be used independently or with another kernel subsystem, | ||
| 365 | such as SELinux. | ||
| 366 | |||
| 367 | config AUDIT_WATCH | ||
| 368 | def_bool y | ||
| 369 | depends on AUDITSYSCALL | ||
| 370 | select FSNOTIFY | ||
| 371 | |||
| 372 | config AUDIT_TREE | ||
| 373 | def_bool y | ||
| 374 | depends on AUDITSYSCALL | ||
| 375 | select FSNOTIFY | ||
| 376 | |||
| 377 | config AUDIT_LOGINUID_IMMUTABLE | ||
| 378 | bool "Make audit loginuid immutable" | ||
| 379 | depends on AUDIT | ||
| 380 | help | ||
| 381 | The config option toggles if a task setting its loginuid requires | ||
| 382 | CAP_SYS_AUDITCONTROL or if that task should require no special permissions | ||
| 383 | but should instead only allow setting its loginuid if it was never | ||
| 384 | previously set. On systems which use systemd or a similar central | ||
| 385 | process to restart login services this should be set to true. On older | ||
| 386 | systems in which an admin would typically have to directly stop and | ||
| 387 | start processes this should be set to false. Setting this to true allows | ||
| 388 | one to drop potentially dangerous capabilites from the login tasks, | ||
| 389 | but may not be backwards compatible with older init systems. | ||
| 390 | |||
| 391 | source "kernel/irq/Kconfig" | ||
| 392 | source "kernel/time/Kconfig" | ||
| 393 | 438 | ||
| 394 | menu "RCU Subsystem" | 439 | menu "RCU Subsystem" |
| 395 | 440 | ||
