mirror of
https://github.com/openharmony/kernel_linux_common_modules.git
synced 2026-08-27 09:41:18 -04:00
staralien
0afc82cd6f
--------------------------------------- DEC(Dynamic Enhance Control) is a dynamic file access enhancement mechanism. It resolves DAC interception and sharefs security risks, precisely controlling file access via a kernel permission database, ioctl interfaces and LSM framework. DEC will bind the token ID of the application and the paths it can access. The user-level sandboxmanager module and appspawn module will configure the relevant policies. When the application accesses the control paths under the sharefs file system, DEC checks the: create, read, write, remove, rename, move, access of files by the application. Signed-off-by: staralien <chengxin@servicecenter-harmonytsc.com>
24 lines
644 B
Plaintext
24 lines
644 B
Plaintext
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
# Copyright (c) 2024 Huawei Device Co., Ltd.
|
|
#
|
|
config SECURITY_DEC
|
|
bool "Data enhance control features"
|
|
|
|
depends on SECURITY_PATH
|
|
default y
|
|
help
|
|
This option enables file operation permission verification
|
|
at VFS layer.
|
|
|
|
If unsure, say N.
|
|
|
|
config SECURITY_DEC_DEVELOP
|
|
bool "Enable Data enhance control develop mode"
|
|
|
|
depends on SECURITY_DEC
|
|
default y
|
|
help
|
|
This option controls the operating mode of Data Enhance Control:
|
|
- If enabled (Y): DEC runs in DEVELOP mode.
|
|
- If disabled (N): DEC runs in PRODUCT mode, which enforces strict
|
|
permission checks and log desensitization |