1 # SPDX-License-Identifier: GPL-2.0-only 1 # SPDX-License-Identifier: GPL-2.0-only
2 config SECURITY_SAFESETID 2 config SECURITY_SAFESETID
3 bool "Gate setid transitions to limit 3 bool "Gate setid transitions to limit CAP_SET{U/G}ID capabilities"
4 depends on SECURITY 4 depends on SECURITY
5 select SECURITYFS 5 select SECURITYFS
6 default n 6 default n
7 help 7 help
8 SafeSetID is an LSM module that gate 8 SafeSetID is an LSM module that gates the setid family of syscalls to
9 restrict UID/GID transitions from a 9 restrict UID/GID transitions from a given UID/GID to only those
10 approved by a system-wide whitelist. 10 approved by a system-wide whitelist. These restrictions also prohibit
11 the given UIDs/GIDs from obtaining a 11 the given UIDs/GIDs from obtaining auxiliary privileges associated
12 with CAP_SET{U/G}ID, such as allowin 12 with CAP_SET{U/G}ID, such as allowing a user to set up user namespace
13 UID mappings. 13 UID mappings.
14 14
15 If you are unsure how to answer this 15 If you are unsure how to answer this question, answer N.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.