diff options
| author | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2016-10-20 00:10:27 -0300 |
|---|---|---|
| committer | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2016-10-20 00:10:27 -0300 |
| commit | d0b2f91bede3bd5e3d24dd6803e56eee959c1797 (patch) | |
| tree | 7fee4ab0509879c373c4f2cbd5b8a5be5b4041ee /security/apparmor/Kconfig | |
| parent | e914f8eb445e8f74b00303c19c2ffceaedd16a05 (diff) | |
Linux-libre 4.8.2-gnupck-4.8.2-gnu
Diffstat (limited to 'security/apparmor/Kconfig')
| -rw-r--r-- | security/apparmor/Kconfig | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig index 232469baa..be5e9414a 100644 --- a/security/apparmor/Kconfig +++ b/security/apparmor/Kconfig @@ -31,13 +31,26 @@ config SECURITY_APPARMOR_BOOTPARAM_VALUE If you are unsure how to answer this question, answer 1. config SECURITY_APPARMOR_HASH - bool "SHA1 hash of loaded profiles" + bool "Enable introspection of sha1 hashes for loaded profiles" depends on SECURITY_APPARMOR select CRYPTO select CRYPTO_SHA1 default y help - This option selects whether sha1 hashing is done against loaded - profiles and exported for inspection to user space via the apparmor - filesystem. + This option selects whether introspection of loaded policy + is available to userspace via the apparmor filesystem. + +config SECURITY_APPARMOR_HASH_DEFAULT + bool "Enable policy hash introspection by default" + depends on SECURITY_APPARMOR_HASH + default y + + help + This option selects whether sha1 hashing of loaded policy + is enabled by default. The generation of sha1 hashes for + loaded policy provide system administrators a quick way + to verify that policy in the kernel matches what is expected, + however it can slow down policy load on some devices. In + these cases policy hashing can be disabled by default and + enabled only if needed. |