#
# RSBAC configuration
# (c) 1999-2001 Amon Ott <ao@rsbac.org>
#
bool 'Initialize RSBAC in separate kernel thread' CONFIG_RSBAC_INIT_THREAD
if [ "$CONFIG_RSBAC_INIT_THREAD" = "y" ]; then
    int '  Initialization timeout in seconds' CONFIG_RSBAC_MAX_INIT_TIME 60
fi
bool 'RSBAC proc support' CONFIG_RSBAC_PROC
bool 'Check on init' CONFIG_RSBAC_INIT_CHECK
bool 'Disable RSBAC writing to disk' CONFIG_RSBAC_NO_WRITE
if [ "$CONFIG_RSBAC_NO_WRITE" = "n" ]; then
    bool '  Allow attribute writing on MSDOS filesystems' CONFIG_RSBAC_MSDOS_WRITE
    int '  RSBAC auto write to disk interval in seconds' CONFIG_RSBAC_AUTO_WRITE 2
fi
bool 'RSBAC debugging support' CONFIG_RSBAC_DEBUG
bool 'Show more options' CONFIG_RSBAC_ADVANCED
if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
  bool 'Provide DEV and USER backup files' CONFIG_RSBAC_DEV_USER_BACKUP
  int 'RSBAC default security officer user ID' CONFIG_RSBAC_SECOFF_UID 400
fi
comment ' '
bool 'RSBAC Maintenance Kernel' CONFIG_RSBAC_MAINT
comment ' '
bool 'RSBAC network support' CONFIG_RSBAC_NET
if [ "$CONFIG_RSBAC_NET" = "y" ]; then
  bool '  Net device control' CONFIG_RSBAC_NET_DEV
  if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
    bool '    Treat virtual devices as individuals' CONFIG_RSBAC_NET_DEV_VIRT
    bool '    Individual network device logging' CONFIG_RSBAC_IND_NETDEV_LOG
  fi
  bool '  Net object control (sockets)' CONFIG_RSBAC_NET_OBJ
  if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
    if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
      bool '    Control UNIX address family' CONFIG_RSBAC_NET_OBJ_UNIX
      bool '    Also intercept network object read and write' CONFIG_RSBAC_NET_OBJ_RW
    fi
    bool '    Individual network object logging' CONFIG_RSBAC_IND_NETOBJ_LOG
  fi
fi
comment ' '
bool 'Support for Registration of decision modules (REG)' CONFIG_RSBAC_REG
if [ "$CONFIG_RSBAC_REG" = "y" ]; then
  bool '  Build REG sample modules' CONFIG_RSBAC_REG_SAMPLES
fi
comment ' '
bool 'RSBAC support for MAC policy' CONFIG_RSBAC_MAC
if [ "$CONFIG_RSBAC_MAC" = "y" ]; then
  bool '  MAC inherit as default' CONFIG_RSBAC_MAC_DEF_INHERIT
  if [ "$CONFIG_RSBAC_MAC_DEF_INHERIT" = "y" ]; then
    bool '    Smart inherit' CONFIG_RSBAC_MAC_SMART_INHERIT
  fi
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  MAC protection for AUTH module' CONFIG_RSBAC_MAC_AUTH_PROT
    bool '  MAC protection for GENeral attributes' CONFIG_RSBAC_MAC_GEN_PROT
  fi
  bool '  Light MAC edition' CONFIG_RSBAC_MAC_LIGHT    
  if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
    bool '  MAC network device protection' CONFIG_RSBAC_MAC_NET_DEV_PROT
  fi
  if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
    bool '  MAC network object protection' CONFIG_RSBAC_MAC_NET_OBJ_PROT
  fi
fi
if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
  bool 'RSBAC support for FC policy' CONFIG_RSBAC_FC
  if [ "$CONFIG_RSBAC_FC" = "y" ]; then
    bool '  FC protection for AUTH module' CONFIG_RSBAC_FC_AUTH_PROT
    bool '  FC protection for GENeral attributes' CONFIG_RSBAC_FC_GEN_PROT
    if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
      bool '  FC network device protection' CONFIG_RSBAC_FC_NET_DEV_PROT
    fi
    if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
      bool '  FC network object protection' CONFIG_RSBAC_FC_NET_OBJ_PROT
    fi
  fi
  bool 'RSBAC support for SIM policy' CONFIG_RSBAC_SIM
  if [ "$CONFIG_RSBAC_SIM" = "y" ]; then
    bool '  SIM protection for AUTH module' CONFIG_RSBAC_SIM_AUTH_PROT
    bool '  SIM protection for GENeral attributes' CONFIG_RSBAC_SIM_GEN_PROT
    if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
      bool '  SIM network device protection' CONFIG_RSBAC_SIM_NET_DEV_PROT
    fi
    if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
      bool '  SIM network object protection' CONFIG_RSBAC_SIM_NET_OBJ_PROT
    fi
  fi
fi
bool 'RSBAC support for PM policy' CONFIG_RSBAC_PM
if [ "$CONFIG_RSBAC_PM" = "y" ]; then
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  PM protection for AUTH module' CONFIG_RSBAC_PM_AUTH_PROT
    bool '  PM protection for GENeral attributes' CONFIG_RSBAC_PM_GEN_PROT
  fi
#  if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
#    bool '  PM network device protection' CONFIG_RSBAC_PM_NET_DEV_PROT
#  fi
#  if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
#    bool '  PM network object protection' CONFIG_RSBAC_PM_NET_OBJ_PROT
#  fi
fi
bool 'RSBAC support for MS policy' CONFIG_RSBAC_MS
if [ "$CONFIG_RSBAC_MS" = "y" ]; then
  int  '  Scanning result lifetime in seconds' CONFIG_RSBAC_MS_TTL 604800
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  Keep scanning results over reboot' CONFIG_RSBAC_MS_PERSIST
    bool '  Export do_scan for external scanner modules' CONFIG_RSBAC_MS_EXTERNAL
    if [ "$CONFIG_RSBAC_MS_EXTERNAL" = "y" ]; then
      bool '    Disable internal do_scan' CONFIG_RSBAC_MS_NO_INTERNAL
    fi
  fi
  bool '  Also check read-open and read-write-open' CONFIG_RSBAC_MS_READ
  bool '  Also do socket scan' CONFIG_RSBAC_MS_SOCK
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  MS protection for AUTH module' CONFIG_RSBAC_MS_AUTH_PROT
  fi
fi
bool 'RSBAC support for FF policy' CONFIG_RSBAC_FF
if [ "$CONFIG_RSBAC_FF" = "y" ]; then
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  FF protection for AUTH module' CONFIG_RSBAC_FF_AUTH_PROT
    bool '  FF protection for GENeral attributes' CONFIG_RSBAC_FF_GEN_PROT
  fi
fi
bool 'RSBAC support for RC policy' CONFIG_RSBAC_RC
if [ "$CONFIG_RSBAC_RC" = "y" ]; then
  bool '  RC protection for AUTH module' CONFIG_RSBAC_RC_AUTH_PROT
  bool '  RC protection for GENeral attributes' CONFIG_RSBAC_RC_GEN_PROT
  if [ "$CONFIG_RSBAC_PROC" = "y" ]; then
    bool '  Provide RC backup files' CONFIG_RSBAC_RC_BACKUP
  fi
  if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
    bool '  RC network device protection' CONFIG_RSBAC_RC_NET_DEV_PROT
  fi
  if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
    bool '  RC network object protection' CONFIG_RSBAC_RC_NET_OBJ_PROT
  fi
fi
bool 'RSBAC support for AUTH policy' CONFIG_RSBAC_AUTH
if [ "$CONFIG_RSBAC_AUTH" = "y" ]; then
  bool '  AUTH module and attribute protection' CONFIG_RSBAC_AUTH_AUTH_PROT
fi
bool 'RSBAC support for ACL policy' CONFIG_RSBAC_ACL
if [ "$CONFIG_RSBAC_ACL" = "y" ]; then
  bool '  Allow masking out of SUPERVISOR right' CONFIG_RSBAC_ACL_SUPER_FILTER
  bool '  ACL protection for AUTH module' CONFIG_RSBAC_ACL_AUTH_PROT
  bool '  ACL protection for GENeral attributes' CONFIG_RSBAC_ACL_GEN_PROT
  if [ "$CONFIG_RSBAC_PROC" = "y" ]; then
    bool '  Provide ACL backup files' CONFIG_RSBAC_ACL_BACKUP
  fi
  if [ "$CONFIG_RSBAC_NET_DEV" = "y" ]; then
    bool '  ACL network device protection' CONFIG_RSBAC_ACL_NET_DEV_PROT
  fi
  if [ "$CONFIG_RSBAC_NET_OBJ" = "y" ]; then
    bool '  ACL network object protection' CONFIG_RSBAC_ACL_NET_OBJ_PROT
  fi
fi
bool 'RSBAC support for Linux Caps (CAP) policy' CONFIG_RSBAC_CAP
if [ "$CONFIG_RSBAC_CAP" = "y" ]; then
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool '  CAP protection for AUTH module' CONFIG_RSBAC_CAP_AUTH_PROT
  fi
fi
if [ "$CONFIG_RSBAC_MAINT" = "n" ]; then
  comment ' '
  bool 'RSBAC policies switchable' CONFIG_RSBAC_SWITCH
  bool 'RSBAC soft mode' CONFIG_RSBAC_SOFTMODE
  if [ "$CONFIG_RSBAC_SOFTMODE" = "y" ]; then
    bool '  Toggle soft mode with SysRq-X' CONFIG_RSBAC_SOFTMODE_SYSRQ
    if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
      bool '  Individual module softmode support' CONFIG_RSBAC_SOFTMODE_IND
    fi
  fi
  bool 'Allow disabling of Linux filesystem access control' CONFIG_RSBAC_ALLOW_DAC_DISABLE
  if [ "$CONFIG_RSBAC_ALLOW_DAC_DISABLE" = "y" ]; then
    if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
      bool '  Allow full disabling (DANGEROUS!)' CONFIG_RSBAC_ALLOW_DAC_DISABLE_FULL
    fi
    bool '  Allow partial (dir tree based) disabling' CONFIG_RSBAC_ALLOW_DAC_DISABLE_PART
  fi
  bool 'Support secure_delete' CONFIG_RSBAC_SECDEL
  bool 'Intercept sys_read and sys_write' CONFIG_RSBAC_RW
  bool 'RSBAC check sys_syslog' CONFIG_RSBAC_SYSLOG
  if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
    bool 'No decision on net mounts' CONFIG_RSBAC_NO_DECISION_ON_NETMOUNT
    bool 'RSBAC symlink redirection' CONFIG_RSBAC_SYM_REDIR
    if [ "$CONFIG_RSBAC_SYM_REDIR" = "y" ]; then
      bool '  Add user ID number' CONFIG_RSBAC_SYM_REDIR_UID
      if [ "$CONFIG_RSBAC_RC" = "y" ]; then
        bool '  Add RC role number' CONFIG_RSBAC_SYM_REDIR_RC
      fi
    fi
  fi
  bool 'X support (normal user MODIFY_PERM access to ST_ioports)' CONFIG_RSBAC_USER_MOD_IOPERM
  bool 'Individual file/dir/dev object logging' CONFIG_RSBAC_IND_LOG
  bool 'Individual user logging' CONFIG_RSBAC_IND_USER_LOG
  bool 'Individual program logging' CONFIG_RSBAC_IND_PROG_LOG
  bool 'Log full path' CONFIG_RSBAC_LOG_FULL_PATH
  if [ "$CONFIG_RSBAC_LOG_FULL_PATH" = "y" ]; then
    int '  Maximum path length (256 - ?)' CONFIG_RSBAC_MAX_PATH_LEN 1024
  fi
  bool 'RSBAC own logging facility' CONFIG_RSBAC_RMSG
  if [ "$CONFIG_RSBAC_RMSG" = "y" ]; then
    if [ "$CONFIG_RSBAC_ADVANCED" = "y" ]; then
      bool '  Do not log to syslog' CONFIG_RSBAC_RMSG_EXCL
      if [ "$CONFIG_RSBAC_RMSG_EXCL" = "n" ]; then
        bool '  Allow to disable logging to syslog' CONFIG_RSBAC_RMSG_NOSYSLOG
      fi
    fi
  fi
  if [ "$CONFIG_RSBAC_PROC" = "y" ]; then
    bool 'RSBAC extra statistics' CONFIG_RSBAC_XSTATS
  fi
fi
