diff options
Diffstat (limited to 'init')
| -rw-r--r-- | init/Kconfig | 14 |
1 files changed, 0 insertions, 14 deletions
diff --git a/init/Kconfig b/init/Kconfig index fed81b576f29..18a98c893d07 100644 --- a/init/Kconfig +++ b/init/Kconfig | |||
| @@ -301,20 +301,6 @@ config AUDIT_TREE | |||
| 301 | depends on AUDITSYSCALL | 301 | depends on AUDITSYSCALL |
| 302 | select FSNOTIFY | 302 | select FSNOTIFY |
| 303 | 303 | ||
| 304 | config AUDIT_LOGINUID_IMMUTABLE | ||
| 305 | bool "Make audit loginuid immutable" | ||
| 306 | depends on AUDIT | ||
| 307 | help | ||
| 308 | The config option toggles if a task setting its loginuid requires | ||
| 309 | CAP_SYS_AUDITCONTROL or if that task should require no special permissions | ||
| 310 | but should instead only allow setting its loginuid if it was never | ||
| 311 | previously set. On systems which use systemd or a similar central | ||
| 312 | process to restart login services this should be set to true. On older | ||
| 313 | systems in which an admin would typically have to directly stop and | ||
| 314 | start processes this should be set to false. Setting this to true allows | ||
| 315 | one to drop potentially dangerous capabilites from the login tasks, | ||
| 316 | but may not be backwards compatible with older init systems. | ||
| 317 | |||
| 318 | source "kernel/irq/Kconfig" | 304 | source "kernel/irq/Kconfig" |
| 319 | source "kernel/time/Kconfig" | 305 | source "kernel/time/Kconfig" |
| 320 | 306 | ||
