diff options
| author | John Johansen <john.johansen@canonical.com> | 2021-02-03 01:35:12 -0800 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-07-09 15:13:59 -0700 |
| commit | 5bfcbd22ee4e6ad5ae698518fadd0f03ea109537 (patch) | |
| tree | 6724a92839d6ab4b84e590ecf14a09911df81090 /security/apparmor/Kconfig | |
| parent | d61c57fde81915c04b41982f66a159ccc014e799 (diff) | |
apparmor: Enable tuning of policy paranoid load for embedded systems
AppArmor by default does an extensive check on loaded policy that
can take quite some time on limited resource systems. Allow
disabling this check for embedded systems where system images are
readonly and have checksumming making the need for the embedded
policy to be fully checked to be redundant.
Note: basic policy checks are still done.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/Kconfig')
| -rw-r--r-- | security/apparmor/Kconfig | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig index 4c34a28a2ddf..cb3496e00d8a 100644 --- a/security/apparmor/Kconfig +++ b/security/apparmor/Kconfig @@ -94,6 +94,17 @@ config SECURITY_APPARMOR_EXPORT_BINARY also increases policy load time. This option is required for checkpoint and restore support, and debugging of loaded policy. +config SECURITY_APPARMOR_PARANOID_LOAD + bool "Perform full verification of loaded policy" + depends on SECURITY_APPARMOR + default y + help + This options allows controlling whether apparmor does a full + verification of loaded policy. This should not be disabled + except for embedded systems where the image is read only, + includes policy, and has some form of integrity check. + Disabling the check will speed up policy loads. + config SECURITY_APPARMOR_KUNIT_TEST bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS depends on KUNIT=y && SECURITY_APPARMOR |