choice 'Security level' \
        "Low		CONFIG_GRKERNSEC_LOW \
         Medium		CONFIG_GRKERNSEC_MID \
         High		CONFIG_GRKERNSEC_HI \
	  Customized	CONFIG_GRKERNSEC_CUSTOM" Customized
if [ "$CONFIG_GRKERNSEC_LOW" = "y" ]; then
define_bool CONFIG_GRKERNSEC_RANDSRC n
define_bool CONFIG_GRKERNSEC_RANDRPC n
define_bool CONFIG_GRKERNSEC_RANDPING n
define_bool CONFIG_GRKERNSEC_FORKFAIL n
define_bool CONFIG_GRKERNSEC_TIME n
define_bool CONFIG_GRKERNSEC_SIGNAL n
define_bool CONFIG_GRKERNSEC_CHROOT_MOUNT n
define_bool CONFIG_GRKERNSEC_CHROOT_DOUBLE n
define_bool CONFIG_GRKERNSEC_CHROOT_PIVOT n
define_bool CONFIG_GRKERNSEC_CHROOT_MKNOD n
define_bool CONFIG_GRKERNSEC_PROC n
define_bool CONFIG_GRKERNSEC_PROC_MEMMAP n
define_bool CONFIG_GRKERNSEC_CHROOT_CAPS n
define_bool CONFIG_GRKERNSEC_PROC_USERGROUP n
define_bool CONFIG_GRKERNSEC_KMEM n
define_bool CONFIG_GRKERNSEC_PROC_ADD n
define_bool CONFIG_GRKERNSEC_CHROOT_FCHDIR n
define_bool CONFIG_GRKERNSEC_CHROOT_CHMOD n
define_bool CONFIG_GRKERNSEC_CHROOT_NICE n
define_bool CONFIG_GRKERNSEC_CHROOT_FINDTASK n
define_bool CONFIG_GRKERNSEC_PAX_RANDUSTACK n
define_bool CONFIG_GRKERNSEC_PAX_RANDKSTACK n
define_bool CONFIG_GRKERNSEC_PAX_ASLR n
define_bool CONFIG_GRKERNSEC_PAX_RANDMMAP n
if [ "$CONFIG_X86" = "y" ]; then
define_bool CONFIG_GRKERNSEC_PAX_NOEXEC n
define_bool CONFIG_GRKERNSEC_PAX_PAGEEXEC n
define_bool CONFIG_GRKERNSEC_PAX_RANDEXEC n
define_bool CONFIG_GRKERNSEC_PAX_SEGMEXEC n
define_bool CONFIG_GRKERNSEC_PAX_EMUTRAMP n
define_bool CONFIG_GRKERNSEC_PAX_MPROTECT n
fi
define_bool CONFIG_GRKERNSEC_AUDIT_MOUNT n
define_bool CONFIG_GR_DEBUG n
define_bool CONFIG_GR_SUPERDEBUG n
define_int CONFIG_GR_MAXTRIES 3
define_int CONFIG_GR_TIMEOUT 30

define_int  CONFIG_GRKERNSEC_FLOODTIME 10
define_int  CONFIG_GRKERNSEC_FLOODBURST 4
define_bool CONFIG_GRKERNSEC_LINK y
define_bool CONFIG_GRKERNSEC_FIFO y
define_bool CONFIG_GRKERNSEC_RANDPID y
define_bool CONFIG_GRKERNSEC_EXECVE y
define_bool CONFIG_GRKERNSEC_DMESG y
define_bool CONFIG_GRKERNSEC_RANDID y
define_bool CONFIG_GRKERNSEC_CHROOT_CHDIR y
fi
if [ "$CONFIG_GRKERNSEC_MID" = "y" ]; then
define_bool CONFIG_GRKERNSEC_KMEM n
define_bool CONFIG_GRKERNSEC_PROC_MEMMAP n
define_bool CONFIG_GRKERNSEC_PROC_ADD n
define_bool CONFIG_GRKERNSEC_CHROOT_CHMOD n
define_bool CONFIG_GRKERNSEC_CHROOT_NICE n
define_bool CONFIG_GRKERNSEC_CHROOT_FINDTASK n
if [ "$CONFIG_X86" = "y" ]; then
define_bool CONFIG_GRKERNSEC_PAX_NOEXEC n
define_bool CONFIG_GRKERNSEC_PAX_PAGEEXEC n
define_bool CONFIG_GRKERNSEC_PAX_RANDEXEC n
define_bool CONFIG_GRKERNSEC_PAX_SEGMEXEC n
define_bool CONFIG_GRKERNSEC_PAX_EMUTRAMP n
define_bool CONFIG_GRKERNSEC_PAX_MPROTECT n
fi
define_bool CONFIG_GRKERNSEC_AUDIT_MOUNT n
define_bool CONFIG_GRKERNSEC_CHROOT_CAPS n
define_bool CONFIG_GRKERNSEC_AUDIT_MOUNT n
define_bool CONFIG_GR_DEBUG n
define_bool CONFIG_GR_SUPERDEBUG n
define_int CONFIG_GR_MAXTRIES 3
define_int CONFIG_GR_TIMEOUT 30

define_int  CONFIG_GRKERNSEC_FLOODTIME 10
define_int  CONFIG_GRKERNSEC_FLOODBURST 4
define_bool CONFIG_GRKERNSEC_LINK y
define_bool CONFIG_GRKERNSEC_FIFO y
define_bool CONFIG_GRKERNSEC_RANDPID y
define_bool CONFIG_GRKERNSEC_EXECVE y
define_bool CONFIG_GRKERNSEC_DMESG y
define_bool CONFIG_GRKERNSEC_RANDID y
define_bool CONFIG_GRKERNSEC_RANDSRC y
define_bool CONFIG_GRKERNSEC_RANDRPC y
define_bool CONFIG_GRKERNSEC_RANDPING y
define_bool CONFIG_GRKERNSEC_FORKFAIL y
define_bool CONFIG_GRKERNSEC_TIME y
define_bool CONFIG_GRKERNSEC_SIGNAL y
define_bool CONFIG_GRKERNSEC_CHROOT y
define_bool CONFIG_GRKERNSEC_CHROOT_MOUNT y
define_bool CONFIG_GRKERNSEC_CHROOT_PIVOT y
define_bool CONFIG_GRKERNSEC_CHROOT_DOUBLE y
define_bool CONFIG_GRKERNSEC_CHROOT_FCHDIR y
define_bool CONFIG_GRKERNSEC_CHROOT_CHDIR y
define_bool CONFIG_GRKERNSEC_CHROOT_MKNOD y
define_bool CONFIG_GRKERNSEC_PROC y
define_bool CONFIG_GRKERNSEC_PROC_USERGROUP y
define_int  CONFIG_GRKERNSEC_PROC_GID 10
define_bool CONFIG_GRKERNSEC_PAX_RANDUSTACK y
define_bool CONFIG_GRKERNSEC_PAX_RANDKSTACK n
define_bool CONFIG_GRKERNSEC_PAX_ASLR y
define_bool CONFIG_GRKERNSEC_PAX_RANDMMAP y
fi
if [ "$CONFIG_GRKERNSEC_HI" = "y" ]; then
define_int CONFIG_GRKERNSEC_FLOODTIME 10
define_int  CONFIG_GRKERNSEC_FLOODBURST 4
define_bool CONFIG_GRKERNSEC_LINK y
define_bool CONFIG_GRKERNSEC_FIFO y
define_bool CONFIG_GRKERNSEC_RANDPID y
define_bool CONFIG_GRKERNSEC_EXECVE y
define_bool CONFIG_GRKERNSEC_DMESG y
define_bool CONFIG_GRKERNSEC_RANDID y
define_bool CONFIG_GRKERNSEC_RANDSRC y
define_bool CONFIG_GRKERNSEC_RANDRPC y
define_bool CONFIG_GRKERNSEC_RANDPING y
define_bool CONFIG_GRKERNSEC_FORKFAIL y
define_bool CONFIG_GRKERNSEC_TIME y
define_bool CONFIG_GRKERNSEC_SIGNAL y
define_bool CONFIG_GRKERNSEC_CHROOT_MOUNT y
define_bool CONFIG_GRKERNSEC_CHROOT_PIVOT y
define_bool CONFIG_GRKERNSEC_CHROOT_DOUBLE y
define_bool CONFIG_GRKERNSEC_CHROOT_CHDIR y
define_bool CONFIG_GRKERNSEC_CHROOT_MKNOD y
define_bool CONFIG_GRKERNSEC_CHROOT_CAPS y
define_bool CONFIG_GRKERNSEC_CHROOT_FINDTASK y
define_bool CONFIG_GRKERNSEC_PROC y
define_bool CONFIG_GRKERNSEC_PROC_MEMMAP y
define_bool CONFIG_GRKERNSEC_PROC_USERGROUP y
define_int  CONFIG_GRKERNSEC_PROC_GID 10
define_bool CONFIG_GRKERNSEC_KMEM y

define_bool CONFIG_GRKERNSEC_AUDIT_MOUNT n
define_bool CONFIG_GR_DEBUG n
define_bool CONFIG_GR_SUPERDEBUG n
define_int CONFIG_GR_MAXTRIES 3
define_int CONFIG_GR_TIMEOUT 30

define_bool CONFIG_GRKERNSEC_PROC_ADD y
define_bool CONFIG_GRKERNSEC_CHROOT_FCHDIR y
define_bool CONFIG_GRKERNSEC_CHROOT_CHMOD y
define_bool CONFIG_GRKERNSEC_CHROOT_NICE y
define_bool CONFIG_GRKERNSEC_PAX_RANDUSTACK y
define_bool CONFIG_GRKERNSEC_PAX_RANDKSTACK y
define_bool CONFIG_GRKERNSEC_PAX_ASLR y
define_bool CONFIG_GRKERNSEC_PAX_RANDMMAP y
if [ "$CONFIG_X86" = "y" ]; then
define_bool CONFIG_GRKERNSEC_PAX_NOEXEC y
define_bool CONFIG_GRKERNSEC_PAX_PAGEEXEC n
define_bool CONFIG_GRKERNSEC_PAX_RANDEXEC y
define_bool CONFIG_GRKERNSEC_PAX_SEGMEXEC y
define_bool CONFIG_GRKERNSEC_PAX_EMUTRAMP n
define_bool CONFIG_GRKERNSEC_PAX_MPROTECT y
fi
define_bool CONFIG_GRKERNSEC_AUDIT_MOUNT y
fi
if [ "$CONFIG_GRKERNSEC_CUSTOM" = "y" ]; then
mainmenu_option next_comment
comment 'Buffer Overflow Protection'
if [ "$CONFIG_X86" = "y" ]; then
  bool 'Enforce non-executable pages' CONFIG_GRKERNSEC_PAX_NOEXEC
  if [ "$CONFIG_GRKERNSEC_PAX_NOEXEC" = "y" ]; then
    bool 'Paging based non-executable pages' CONFIG_GRKERNSEC_PAX_PAGEEXEC
    bool 'Segmentation based non-executable pages' CONFIG_GRKERNSEC_PAX_SEGMEXEC
    if [ "$CONFIG_GRKERNSEC_PAX_PAGEEXEC" = "y" -o "$CONFIG_GRKERNSEC_PAX_SEGMEXEC" = "y" ]; then
      bool '   Emulate trampolines' CONFIG_GRKERNSEC_PAX_EMUTRAMP
      bool '   Restrict mprotect()' CONFIG_GRKERNSEC_PAX_MPROTECT
    fi
  fi
fi
bool 'Address Space Layout Randomization' CONFIG_GRKERNSEC_PAX_ASLR
if [ "$CONFIG_GRKERNSEC_PAX_ASLR" = "y" ]; then
  if [ "$CONFIG_X86_TSC" = "y" ]; then
    bool '  Randomize kernel stack base' CONFIG_GRKERNSEC_PAX_RANDKSTACK
  fi
  bool '  Randomize user stack base' CONFIG_GRKERNSEC_PAX_RANDUSTACK
  bool '  Randomize mmap() base' CONFIG_GRKERNSEC_PAX_RANDMMAP
  if [ "$CONFIG_GRKERNSEC_PAX_RANDMMAP" = "y" -a "$CONFIG_GRKERNSEC_PAX_NOEXEC" = "y" ]; then
    if [ "$CONFIG_GRKERNSEC_PAX_PAGEEXEC" = "y" -o "$CONFIG_GRKERNSEC_PAX_SEGMEXEC" = "y" ]; then
      bool '  Randomize ET_EXEC base' CONFIG_GRKERNSEC_PAX_RANDEXEC
    fi
  fi
fi
bool 'Deny access to /dev/kmem' CONFIG_GRKERNSEC_KMEM
endmenu
mainmenu_option next_comment
comment 'ACL options'
bool 'ACL Debugging Messages' CONFIG_GR_DEBUG
if [ "$CONFIG_GR_DEBUG" = "y" ]; then
	bool 'Extra ACL Debugging Messages' CONFIG_GR_SUPERDEBUG
fi	
int 'Maximum tries before password lockout' CONFIG_GR_MAXTRIES 3
int 'Time to wait after max password tries, in seconds' CONFIG_GR_TIMEOUT 30
endmenu
mainmenu_option next_comment
comment 'Filesystem Protections'
bool 'Proc restrictions' CONFIG_GRKERNSEC_PROC
if [ "$CONFIG_GRKERNSEC_PROC" != "n" ]; then
bool '   Restrict to user only' CONFIG_GRKERNSEC_PROC_USER
if [ "$CONFIG_GRKERNSEC_PROC_USER" != "n" ]; then
bool '      Additional restrictions' CONFIG_GRKERNSEC_PROC_ADD
bool '      Remove addresses from /proc/pid/maps' CONFIG_GRKERNSEC_PROC_MEMMAP
fi
if [ "$CONFIG_GRKERNSEC_PROC_USER" != "y" ]; then
bool '   Allow special group' CONFIG_GRKERNSEC_PROC_USERGROUP
if [ "$CONFIG_GRKERNSEC_PROC_USERGROUP" != "n" ]; then
int  '   GID for special group' CONFIG_GRKERNSEC_PROC_GID 1001
bool '      Additional restrictions' CONFIG_GRKERNSEC_PROC_ADD
bool '      Remove mem and maps support' CONFIG_GRKERNSEC_PROC_MEMMAP
fi
fi
fi
bool 'Linking restrictions' CONFIG_GRKERNSEC_LINK
bool 'FIFO restrictions' CONFIG_GRKERNSEC_FIFO
bool 'Chroot jail restrictions' CONFIG_GRKERNSEC_CHROOT
if [ "$CONFIG_GRKERNSEC_CHROOT" != "n" ]; then
bool '   Deny mounts' CONFIG_GRKERNSEC_CHROOT_MOUNT
bool '   Deny double-chroots' CONFIG_GRKERNSEC_CHROOT_DOUBLE
bool '   Deny pivot_root in chroot' CONFIG_GRKERNSEC_CHROOT_PIVOT
bool '   Enforce chdir("/") on all chroots' CONFIG_GRKERNSEC_CHROOT_CHDIR
bool '   Deny fchdir outside of chroot' CONFIG_GRKERNSEC_CHROOT_FCHDIR
bool '   Deny (f)chmod +s' CONFIG_GRKERNSEC_CHROOT_CHMOD
bool '   Deny mknod' CONFIG_GRKERNSEC_CHROOT_MKNOD
bool '   Protect outside processes' CONFIG_GRKERNSEC_CHROOT_FINDTASK
bool '   Restrict priority changes' CONFIG_GRKERNSEC_CHROOT_NICE
fi
bool 'Capability restrictions within chroot' CONFIG_GRKERNSEC_CHROOT_CAPS
endmenu
mainmenu_option next_comment
comment 'Kernel Auditing'
bool 'Single group for auditing' CONFIG_GRKERNSEC_AUDIT_GROUP
if [ "$CONFIG_GRKERNSEC_AUDIT_GROUP" != "n" ]; then
int  '   GID for auditing' CONFIG_GRKERNSEC_AUDIT_GID 1007
fi
bool 'Exec logging' CONFIG_GRKERNSEC_EXECLOG
bool 'Log execs within chroot' CONFIG_GRKERNSEC_CHROOT_EXECLOG
bool 'Chdir logging' CONFIG_GRKERNSEC_AUDIT_CHDIR
bool '(Un)Mount logging' CONFIG_GRKERNSEC_AUDIT_MOUNT
bool 'IPC logging' CONFIG_GRKERNSEC_AUDIT_IPC
bool 'Signal logging' CONFIG_GRKERNSEC_SIGNAL
bool 'Fork failure logging' CONFIG_GRKERNSEC_FORKFAIL
bool 'Time change logging' CONFIG_GRKERNSEC_TIME
endmenu
mainmenu_option next_comment
comment 'Executable Protections'
bool 'Exec process limiting' CONFIG_GRKERNSEC_EXECVE
bool 'Dmesg(8) restriction' CONFIG_GRKERNSEC_DMESG
bool 'Randomized PIDs' CONFIG_GRKERNSEC_RANDPID
bool 'Trusted path execution' CONFIG_GRKERNSEC_TPE
if [ "$CONFIG_GRKERNSEC_TPE" != "n" ]; then
bool '   Partially restrict non-root users' CONFIG_GRKERNSEC_TPE_ALL
int  '   GID for untrusted users:' CONFIG_GRKERNSEC_TPE_GID 1005
fi
endmenu
mainmenu_option next_comment
comment 'Network Protections'
bool 'Randomized IP IDs' CONFIG_GRKERNSEC_RANDID
bool 'Randomized TCP source ports' CONFIG_GRKERNSEC_RANDSRC
bool 'Randomized RPC XIDs' CONFIG_GRKERNSEC_RANDRPC
bool 'Altered Ping IDs' CONFIG_GRKERNSEC_RANDPING
bool 'Socket restrictions' CONFIG_GRKERNSEC_SOCKET
if [ "$CONFIG_GRKERNSEC_SOCKET" != "n" ]; then
bool '  Deny any sockets to group' CONFIG_GRKERNSEC_SOCKET_ALL
if [ "$CONFIG_GRKERNSEC_SOCKET_ALL" != "n" ]; then
int  '   GID to deny all sockets for:' CONFIG_GRKERNSEC_SOCKET_ALL_GID 1004
fi
bool '  Deny client sockets to group' CONFIG_GRKERNSEC_SOCKET_CLIENT
if [ "$CONFIG_GRKERNSEC_SOCKET_CLIENT" != "n" ]; then
int  '   GID to deny client sockets for:' CONFIG_GRKERNSEC_SOCKET_CLIENT_GID 1003
fi
bool '  Deny server sockets to group' CONFIG_GRKERNSEC_SOCKET_SERVER
if [ "$CONFIG_GRKERNSEC_SOCKET_SERVER" != "n" ]; then
int  '   GID to deny server sockets for:' CONFIG_GRKERNSEC_SOCKET_SERVER_GID 1002
fi
fi
endmenu
if [ "$CONFIG_SYSCTL" != "n" ]; then
mainmenu_option next_comment
comment 'Sysctl support'
bool 'Sysctl support' CONFIG_GRKERNSEC_SYSCTL
endmenu
fi
mainmenu_option next_comment
comment 'Miscellaneous Features'
int 'Seconds in between log messages (minimum)' CONFIG_GRKERNSEC_FLOODTIME 10
int 'Number of messages in a burst (maximum)' CONFIG_GRKERNSEC_FLOODBURST 4
endmenu
fi
