summaryrefslogtreecommitdiffstats
path: root/security/safesetid/Kconfig
diff options
context:
space:
mode:
Diffstat (limited to 'security/safesetid/Kconfig')
-rw-r--r--security/safesetid/Kconfig15
1 files changed, 15 insertions, 0 deletions
diff --git a/security/safesetid/Kconfig b/security/safesetid/Kconfig
new file mode 100644
index 0000000000..18b5fb9041
--- /dev/null
+++ b/security/safesetid/Kconfig
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0-only
+config SECURITY_SAFESETID
+ bool "Gate setid transitions to limit CAP_SET{U/G}ID capabilities"
+ depends on SECURITY
+ select SECURITYFS
+ default n
+ help
+ SafeSetID is an LSM module that gates the setid family of syscalls to
+ restrict UID/GID transitions from a given UID/GID to only those
+ approved by a system-wide whitelist. These restrictions also prohibit
+ the given UIDs/GIDs from obtaining auxiliary privileges associated
+ with CAP_SET{U/G}ID, such as allowing a user to set up user namespace
+ UID mappings.
+
+ If you are unsure how to answer this question, answer N.