security: remove dummy module

[linux-2.6.git] / security / Kconfig

diff --git a/security/Kconfig b/security/Kconfig
index dcf04a09185de5fbd3507e221de81abbe9be90f1..77def9f9f5f541003addc3fcbc51a7b90117489c 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -22,19 +22,26 @@ config KEYS
          If you are unsure as to whether this is required, answer N.
 
 config KEYS_DEBUG_PROC_KEYS
-       bool "Enable the /proc/keys file by which all keys may be viewed"
+       bool "Enable the /proc/keys file by which keys may be viewed"
        depends on KEYS
        help
-         This option turns on support for the /proc/keys file through which
-         all the keys on the system can be listed.
+         This option turns on support for the /proc/keys file - through which
+         can be listed all the keys on the system that are viewable by the
+         reading process.
 
-         This option is a slight security risk in that it makes it possible
-         for anyone to see all the keys on the system. Normally the manager
-         pretends keys that are inaccessible to a process don't exist as far
-         as that process is concerned.
+         The only keys included in the list are those that grant View
+         permission to the reading process whether or not it possesses them.
+         Note that LSM security checks are still performed, and may further
+         filter out keys that the current process is not authorised to view.
+
+         Only key attributes are listed here; key payloads are not included in
+         the resulting table.
+
+         If you are unsure as to whether this is required, answer N.
 
 config SECURITY
        bool "Enable different security models"
+       depends on SYSFS
        help
          This allows you to choose different security modules to be
          configured into your kernel.
@@ -53,16 +60,32 @@ config SECURITY_NETWORK
          implement socket and networking access controls.
          If you are unsure how to answer this question, answer N.
 
-config SECURITY_CAPABILITIES
-       tristate "Default Linux Capabilities"
-       depends on SECURITY
+config SECURITY_NETWORK_XFRM
+       bool "XFRM (IPSec) Networking Security Hooks"
+       depends on XFRM && SECURITY_NETWORK
+       help
+         This enables the XFRM (IPSec) networking security hooks.
+         If enabled, a security module can use these hooks to
+         implement per-packet access controls based on labels
+         derived from IPSec policy.  Non-IPSec communications are
+         designated as unlabelled, and only sockets authorized
+         to communicate unlabelled data can send without using
+         IPSec.
+         If you are unsure how to answer this question, answer N.
+
+config SECURITY_FILE_CAPABILITIES
+       bool "File POSIX Capabilities (EXPERIMENTAL)"
+       depends on SECURITY && EXPERIMENTAL
+       default n
        help
-         This enables the "default" Linux capabilities functionality.
-         If you are unsure how to answer this question, answer Y.
+         This enables filesystem capabilities, allowing you to give
+         binaries a subset of root's powers without using setuid 0.
+
+         If in doubt, answer N.
 
 config SECURITY_ROOTPLUG
-       tristate "Root Plug Support"
-       depends on USB && SECURITY
+       bool "Root Plug Support"
+       depends on USB=y && SECURITY
        help
          This is a sample LSM module that should only be used as such.
          It prevents any programs running with egid == 0 if a specific
@@ -73,19 +96,28 @@ config SECURITY_ROOTPLUG
          
          If you are unsure how to answer this question, answer N.
 
-config SECURITY_SECLVL
-       tristate "BSD Secure Levels"
-       depends on SECURITY
-       select CRYPTO
-       select CRYPTO_SHA1
-       help
-         Implements BSD Secure Levels as an LSM.  See
-         <file:Documentation/seclvl.txt> for instructions on how to use this
-         module.
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
+        depends on SECURITY
+        default 0
+        help
+         This is the portion of low virtual memory which should be protected
+         from userspace allocation.  Keeping a user from writing to low pages
+         can help reduce the impact of kernel NULL pointer bugs.
+
+         For most ia64, ppc64 and x86 users with lots of address space
+         a value of 65536 is reasonable and should cause no problems.
+         On arm and other archs it should not be higher than 32768.
+         Programs which use vm86 functionality would either need additional
+         permissions from either the LSM or the capabilities module or have
+         this protection disabled.
+
+         This value can be changed after boot using the
+         /proc/sys/vm/mmap_min_addr tunable.
 
-         If you are unsure how to answer this question, answer N.
 
 source security/selinux/Kconfig
+source security/smack/Kconfig
 
 endmenu