- add doc bcond

[packages/kernel.git] / kernel-grsec.config

diff --git a/kernel-grsec.config b/kernel-grsec.config
index 0fe667a5c8b0369e9113119c5a3a49f5505d22f3..3cb2599d9123ada73c5e8865218ffd5eb0216eaa 100644 (file)
--- a/kernel-grsec.config
+++ b/kernel-grsec.config
@@ -3,26 +3,26 @@
 #
 CONFIG_GRKERNSEC=y
 # CONFIG_GRKERNSEC_LOW is not set
-# CONFIG_GRKERNSEC_MID is not set
-# CONFIG_GRKERNSEC_HI is not set
+# CONFIG_GRKERNSEC_MEDIUM is not set
+# CONFIG_GRKERNSEC_HIGH is not set
 CONFIG_GRKERNSEC_CUSTOM=y
 
 #
 # Address Space Protection
 #
-# CONFIG_GRKERNSEC_PAX_NOEXEC is not set
-CONFIG_GRKERNSEC_PAX_ASLR=y
-# CONFIG_GRKERNSEC_PAX_RANDKSTACK is not set
-CONFIG_GRKERNSEC_PAX_RANDUSTACK=y
-CONFIG_GRKERNSEC_PAX_RANDMMAP=y
-CONFIG_GRKERNSEC_KMEM=y
+# CONFIG_GRKERNSEC_KMEM is not set
 # CONFIG_GRKERNSEC_IO is not set
-CONFIG_GRKERNSEC_PROC_MEMMAP=y
+# CONFIG_GRKERNSEC_PROC_MEMMAP is not set
+CONFIG_GRKERNSEC_BRUTE=y
+CONFIG_GRKERNSEC_MODSTOP=y
 # CONFIG_GRKERNSEC_HIDESYM is not set
 
+CONFIG_GRKERNSEC_VM86=y
+
 #
 # Role Based Access Control Options
 #
+# CONFIG_GRKERNSEC_NO_RBAC is not set
 CONFIG_GRKERNSEC_ACL_HIDEKERN=y
 CONFIG_GRKERNSEC_ACL_MAXTRIES=3
 CONFIG_GRKERNSEC_ACL_TIMEOUT=30
@@ -37,7 +37,7 @@ CONFIG_GRKERNSEC_PROC_GID=17
 CONFIG_GRKERNSEC_PROC_ADD=y
 CONFIG_GRKERNSEC_LINK=y
 CONFIG_GRKERNSEC_FIFO=y
-CONFIG_GRKERNSEC_FD=y
+CONFIG_GRKERNSEC_ROFS=y
 CONFIG_GRKERNSEC_CHROOT=y
 CONFIG_GRKERNSEC_CHROOT_MOUNT=y
 CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
@@ -68,25 +68,22 @@ CONFIG_GRKERNSEC_SIGNAL=y
 CONFIG_GRKERNSEC_FORKFAIL=y
 CONFIG_GRKERNSEC_TIME=y
 CONFIG_GRKERNSEC_PROC_IPADDR=y
+CONFIG_GRKERNSEC_AUDIT_TEXTREL=y
 
 #
 # Executable Protections
 #
 CONFIG_GRKERNSEC_EXECVE=y
 CONFIG_GRKERNSEC_DMESG=y
-CONFIG_GRKERNSEC_RANDPID=y
 CONFIG_GRKERNSEC_TPE=y
 CONFIG_GRKERNSEC_TPE_ALL=y
+# CONFIG_GRKERNSEC_TPE_INVERT is not set
 CONFIG_GRKERNSEC_TPE_GID=65500
 
 #
 # Network Protections
 #
 CONFIG_GRKERNSEC_RANDNET=y
-CONFIG_GRKERNSEC_RANDID=y
-CONFIG_GRKERNSEC_RANDISN=y
-CONFIG_GRKERNSEC_RANDSRC=y
-CONFIG_GRKERNSEC_RANDRPC=y
 CONFIG_GRKERNSEC_SOCKET=y
 CONFIG_GRKERNSEC_SOCKET_ALL=y
 CONFIG_GRKERNSEC_SOCKET_ALL_GID=65501
@@ -94,16 +91,21 @@ CONFIG_GRKERNSEC_SOCKET_CLIENT=y
 CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=65502
 CONFIG_GRKERNSEC_SOCKET_SERVER=y
 CONFIG_GRKERNSEC_SOCKET_SERVER_GID=65503
+# CONFIG_GRKERNSEC_BLACKHOLE is not set
 
 #
 # Sysctl support
 #
 CONFIG_GRKERNSEC_SYSCTL=y
+# CONFIG_GRKERNSEC_SYSCTL_ON is not set
 
 #
-# Logging options
+# Logging Options
 #
-CONFIG_GRKERNSEC_FLOODTIME=30
-CONFIG_GRKERNSEC_FLOODBURST=4
+CONFIG_GRKERNSEC_FLOODTIME=10
+CONFIG_GRKERNSEC_FLOODBURST=10
 
 CONFIG_IP_NF_MATCH_STEALTH=m
+
+# CONFIG_GRKERNSEC_MODHARDEN is not set
+CONFIG_GRKERNSEC_HARDEN_PTRACE=y