#
# Grsecurity
#
CONFIG_GRKERNSEC=y
# CONFIG_GRKERNSEC_LOW is not set
# CONFIG_GRKERNSEC_MID is not set
# CONFIG_GRKERNSEC_HI is not set
CONFIG_GRKERNSEC_CUSTOM=y

CONFIG_IP_NF_MATCH_STEALTH=m

# CONFIG_GRKERNSEC_PAX_NOEXEC is not set
# CONFIG_GRKERNSEC_PAX_ASLR is not set

#
# Buffer Overflow Protection
#
CONFIG_GRKERNSEC_STACK=y
CONFIG_GRKERNSEC_STACK_GCC=y
CONFIG_GRKERNSEC_KMEM=y
CONFIG_GRKERNSEC_KSYMS=y
# CONFIG_GRKERNSEC_PAX_RANDMMAP is not set

#
# ACL options
#
# CONFIG_GR_DEBUG is not set
# CONFIG_GRKERNSEC_ACL_CAPLOG is not set
CONFIG_GR_MAXTRIES=3
CONFIG_GR_TIMEOUT=30

#
# Access Control Lists
#
# CONFIG_OBV_PROC is not set
# CONFIG_GRKERNSEC_ACL is not set
#
# Filesystem Protections
#
CONFIG_GRKERNSEC_PROC=y
# CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=17
CONFIG_GRKERNSEC_PROC_ADD=y
# CONFIG_GRKERNSEC_PROC_MEMMAP is not set
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_FD=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_SIG=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_PTRACE=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
CONFIG_GRKERNSEC_AUDIT_CHDIR=y
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
CONFIG_GRKERNSEC_AUDIT_IPC=y
CONFIG_GRKERNSEC_AUDIT_PTRACE=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
CONFIG_GRKERNSEC_KBMAP=y

#
# Kernel Auditing
#
CONFIG_GRKERNSEC_AUDIT_GROUP=y
CONFIG_GRKERNSEC_AUDIT_GID=1007

#
# Security Logging
#
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_SUID=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y

#
# Executable Protections
#
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_RANDPID=y
CONFIG_GRKERNSEC_IPC=y
CONFIG_GRKERNSEC_TTYROOT=y
CONFIG_GRKERNSEC_TTYROOT_PHYS=y
CONFIG_GRKERNSEC_TTYROOT_SERIAL=y
CONFIG_GRKERNSEC_TTYROOT_PSEUDO=y
CONFIG_GRKERNSEC_FORKBOMB=y
CONFIG_GRKERNSEC_FORKBOMB_GID=65504
CONFIG_GRKERNSEC_FORKBOMB_SEC=40
CONFIG_GRKERNSEC_FORKBOMB_MAX=20
CONFIG_GRKERNSEC_TPE=y
CONFIG_GRKERNSEC_TPE_GLIBC=y
CONFIG_GRKERNSEC_TPE_ALL=y
CONFIG_GRKERNSEC_TPE_GID=65500

#
# Network Protections
#
CONFIG_GRKERNSEC_RANDID=y
CONFIG_GRKERNSEC_RANDSRC=y
CONFIG_GRKERNSEC_RANDRPC=y
CONFIG_GRKERNSEC_RANDBIND=y
CONFIG_GRKERNSEC_RANDPING=y
CONFIG_GRKERNSEC_RANDTTL=y
CONFIG_GRKERNSEC_RANDTTL_THRESH=64
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_SOCKET=y
CONFIG_GRKERNSEC_SOCKET_ALL=y
CONFIG_GRKERNSEC_SOCKET_ALL_GID=1004
CONFIG_GRKERNSEC_ALL_GID=65501
CONFIG_GRKERNSEC_SOCKET_CLIENT=y
CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=1003
CONFIG_GRKERNSEC_CLIENT_GID=65502
CONFIG_GRKERNSEC_SOCKET_SERVER=y
CONFIG_GRKERNSEC_SOCKET_SERVER_GID=1002
CONFIG_GRKERNSEC_SERVER_GID=65503
CONFIG_GRKERNSEC_PTRACE=y
CONFIG_GRKERNSEC_PTRACE_GROUP=y
CONFIG_GRKERNSEC_PTRACE_GID=1008
CONFIG_GRKERNSEC_STEALTH=y
CONFIG_GRKERNSEC_STEALTH_RST=y
CONFIG_GRKERNSEC_STEALTH_UDP=y
CONFIG_GRKERNSEC_STEALTH_ICMP=y
CONFIG_GRKERNSEC_STEALTH_IGMP=y
CONFIG_GRKERNSEC_STEALTH_FLAGS=y

#
# Network Logging
#
CONFIG_GRKERNSEC_STEALTH_ICMP_LOG=y
CONFIG_GRKERNSEC_STEALTH_RST_LOG=y
CONFIG_GRKERNSEC_STEALTH_UDP_LOG=y
CONFIG_GRKERNSEC_STEALTH_FLAGS_LOG=y

#
# Sysctl support
#
CONFIG_GRKERNSEC_SYSCTL=y

#
# Miscellaneous Enhancements
#
CONFIG_GRKERNSEC_COREDUMP=y
CONFIG_GRKERNSEC_FLOODTIME=30
CONFIG_GRKERNSEC_FLOODBURST=4

# 1.9.8-rc1
CONFIG_GRKERNSEC_MEM=y
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_RESLOG=y
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30
# CONFIG_GRKERNSEC_CHROOT_SHMAT is not set
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_RANDISN=y
# CONFIG_GRKERNSEC_HIDESYM is not set
CONFIG_GRKERNSEC_PROC_IPADDR=y