# Grsecurity/Appendix/Grsecurity and PaX Configuration Options
## Introduction

This is a list of all grsecurity and PaX configuration options in the kernel. You can access this same information using the kernel configuration's built-in help. This page contains only the configuration options present in the latest stable grsecurity release. The grsecurity options are available under Security options » Grsecurity.
Each option contains the corresponding kernel configuration symbol (e.g. GRKERNSEC_FIFO), all related sysctl variable names if the option is configurable through sysctl, and description of the option.

# Grsecurity (top level menu)
## Grsecurity

GRKERNSEC

## Configuration Method
### Automatic

GRKERNSEC_CONFIG_AUTO

### Custom

GRKERNSEC_CONFIG_CUSTOM

## Usage Type
### Server

CARTERPONDSEC_CONFIG_SERVER
Carterpoundssec

### Desktop

GRKERNSEC_CONFIG_DESKTOP

## Virtualization Type
### None

GRKERNSEC_CONFIG_VIRT_NONE

### Guest

GRKERNSEC_CONFIG_VIRT_GUEST

### Host

GRKERNSEC_CONFIG_VIRT_HOST

## Virtualization Hardware
### EPT/RVI Processor Support

GRKERNSEC_CONFIG_VIRT_EPT

### First-gen/No Hardware Virtualization

GRKERNSEC_CONFIG_VIRT_SOFT

## Virtualization Software
### Xen

GRKERNSEC_CONFIG_VIRT_XEN

### VMWare

GRKERNSEC_CONFIG_VIRT_VMWARE

### KVM

GRKERNSEC_CONFIG_VIRT_KVM

### VirtualBox

GRKERNSEC_CONFIG_VIRT_VIRTUALBOX

## Required Priorities
### Performance

GRKERNSEC_CONFIG_PRIORITY_PERF

### Security

GRKERNSEC_CONFIG_PRIORITY_SECURITY

## Default Special Groups
### GID exempted from /proc restrictions

GRKERNSEC_PROC_GID

### GID for TPE-untrusted users

GRKERNSEC_TPE_UNTRUSTED_GID

### GID for TPE-trusted users

GRKERNSEC_TPE_TRUSTED_GID

### GID for users with kernel-enforced SymlinksIfOwnerMatch

GRKERNSEC_SYMLINKOWN_GID

## Customize Configuration
### PaX
#### Enable various PaX features

PAX

#### PaX Control
##### Support soft mode

PAX_SOFTMODE

##### Use legacy ELF header marking

PAX_EI_PAX

##### Use ELF program header marking

PAX_PT_PAX_FLAGS

##### Use filesystem extended attributes marking

PAX_XATTR_PAX_FLAGS

##### MAC system integration
###### none

PAX_NO_ACL_FLAGS

###### direct

PAX_HAVE_ACL_FLAGS

###### hook

PAX_HOOK_ACL_FLAGS

#### Non-executable pages
##### Enforce non-executable pages

PAX_NOEXEC

##### Paging based non-executable pages

PAX_PAGEEXEC

##### Segmentation based non-executable pages

PAX_SEGMEXEC

##### Emulate trampolines

PAX_EMUTRAMP

##### Automatically emulate sigreturn trampolines

PAX_EMUSIGRT

##### Restrict mprotect

PAX_MPROTECT

##### Use legacy/compat protection demoting (read help)

PAX_MPROTECT_COMPAT

##### Allow ELF text relocations (read help)

PAX_ELFRELOCS

##### Allow ELF ET_EXEC text relocations

PAX_ETEXECRELOCS

##### Automatically emulate ELF PLT

PAX_EMUPLT

##### Emulate old glibc resolver stub

PAX_DLRESOLVE

##### Enforce non-executable kernel pages

PAX_KERNEXEC

##### Return Address Instrumentation Method
###### bts

PAX_KERNEXEC_PLUGIN_METHOD_BTS

##### bts

PAX_KERNEXEC_PLUGIN_METHOD

##### Minimum amount of memory reserved for module code

PAX_KERNEXEC_MODULE_TEXT

#### Address Space Layout Randomization
##### Address Space Layout Randomization

PAX_ASLR

##### Randomize kernel stack base

PAX_RANDKSTACK

##### Randomize user stack base

PAX_RANDUSTACK

##### Randomize mmap base

PAX_RANDMMAP

#### Miscellaneous hardening features
##### Sanitize all freed memory

PAX_MEMORY_SANITIZE

##### Sanitize kernel stack

PAX_MEMORY_STACKLEAK

##### Forcibly initialize local variables copied to userland

PAX_MEMORY_STRUCTLEAK

##### Prevent invalid userland pointer dereference

PAX_MEMORY_UDEREF

##### Prevent various kernel object reference counter overflows

PAX_REFCOUNT

##### Automatically constify eligible structures

PAX_CONSTIFY_PLUGIN

##### Harden heap object copies between kernel and userland

PAX_USERCOPY

##### Prevent various integer overflows in function size parameters

PAX_SIZE_OVERFLOW

##### Generate some entropy during boot and runtime

PAX_LATENT_ENTROPY

##### Prevent code reuse attacks

PAX_RAP

### Memory Protections
#### Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port

GRKERNSEC_KMEM

#### Restrict VM86 mode

GRKERNSEC_VM86

#### Disable privileged I/O

GRKERNSEC_IO Related sysctl variables:
    kernel.grsecurity.disable_priv_io

#### Harden BPF JIT against spray attacks

GRKERNSEC_JIT_HARDEN

#### Disable unprivileged PERF_EVENTS usage by default

GRKERNSEC_PERF_HARDEN

#### Insert random gaps between thread stacks

GRKERNSEC_RAND_THREADSTACK

#### Harden ASLR against information leaks and entropy reduction

GRKERNSEC_PROC_MEMMAP

#### Prevent kernel stack overflows

GRKERNSEC_KSTACKOVERFLOW

#### Deter exploit bruteforcing

GRKERNSEC_BRUTE Related sysctl variables:
    kernel.grsecurity.deter_bruteforce

#### Harden module auto-loading

GRKERNSEC_MODHARDEN

#### Hide kernel symbols

GRKERNSEC_HIDESYM

#### Randomize layout of sensitive kernel structures

GRKERNSEC_RANDSTRUCT

#### Use cacheline-aware structure randomization

GRKERNSEC_RANDSTRUCT_PERFORMANCE

#### Active kernel exploit response

GRKERNSEC_KERN_LOCKOUT

#### Old ARM userland compatibility

GRKERNSEC_OLD_ARM_USERLAND

### Role Based Access Control Options
#### Disable RBAC system

GRKERNSEC_NO_RBAC

#### Hide kernel processes

GRKERNSEC_ACL_HIDEKERN

#### Maximum tries before password lockout

GRKERNSEC_ACL_MAXTRIES

#### Time to wait after max password tries, in seconds

GRKERNSEC_ACL_TIMEOUT

### Filesystem Protections
#### Proc restrictions

GRKERNSEC_PROC

#### Restrict /proc to user only

GRKERNSEC_PROC_USER

#### Allow special group

GRKERNSEC_PROC_USERGROUP

#### GID exempted from /proc restrictions

GRKERNSEC_PROC_GID

#### Additional restrictions

GRKERNSEC_PROC_ADD

#### Linking restrictions

GRKERNSEC_LINK Related sysctl variables:
    kernel.grsecurity.linking_restrictions

#### Kernel-enforced SymlinksIfOwnerMatch

GRKERNSEC_SYMLINKOWN Related sysctl variables:
    kernel.grsecurity.enforce_symlinksifowner
    kernel.grsecurity.symlinkown_gid

#### GID for users with kernel-enforced SymlinksIfOwnerMatch

GRKERNSEC_SYMLINKOWN_GID

#### FIFO restrictions

GRKERNSEC_FIFO Related sysctl variables:
    kernel.grsecurity.fifo_restrictions

#### Sysfs/debugfs restriction

GRKERNSEC_SYSFS_RESTRICT

#### Runtime read-only mount protection

GRKERNSEC_ROFS Related sysctl variables:
    kernel.grsecurity.romount_protect

#### Eliminate stat/notify-based device sidechannels

GRKERNSEC_DEVICE_SIDECHANNEL

#### Chroot jail restrictions

GRKERNSEC_CHROOT

#### Deny mounts

GRKERNSEC_CHROOT_MOUNT Related sysctl variables:
    kernel.grsecurity.chroot_deny_mount

#### Deny double-chroots

GRKERNSEC_CHROOT_DOUBLE Related sysctl variables:
    kernel.grsecurity.chroot_deny_chroot

#### Deny pivot_root in chroot

GRKERNSEC_CHROOT_PIVOT Related sysctl variables:
    kernel.grsecurity.chroot_deny_pivot

#### Enforce chdir("/")

GRKERNSEC_CHROOT_CHDIR Related sysctl variables:
    kernel.grsecurity.chroot_enforce_chdir

#### Deny (f)chmod +s

GRKERNSEC_CHROOT_CHMOD Related sysctl variables:
    kernel.grsecurity.chroot_deny_chmod

#### Deny fchdir out of chroot

GRKERNSEC_CHROOT_FCHDIR Related sysctl variables:
    kernel.grsecurity.chroot_deny_fchdir

#### Deny mknod

GRKERNSEC_CHROOT_MKNOD Related sysctl variables:
    kernel.grsecurity.chroot_deny_mknod

#### Deny shmat out of chroot

GRKERNSEC_CHROOT_SHMAT Related sysctl variables:
    kernel.grsecurity.chroot_deny_shmat

#### Deny access to abstract AF_UNIX sockets out of chroot

GRKERNSEC_CHROOT_UNIX Related sysctl variables:
    kernel.grsecurity.chroot_deny_unix

#### Protect outside processes

GRKERNSEC_CHROOT_FINDTASK Related sysctl variables:
    kernel.grsecurity.chroot_findtask

#### Restrict priority changes

GRKERNSEC_CHROOT_NICE Related sysctl variables:
    kernel.grsecurity.chroot_restrict_nice

#### Deny sysctl writes

GRKERNSEC_CHROOT_SYSCTL Related sysctl variables:
    kernel.grsecurity.chroot_deny_sysctl

#### Capability restrictions

GRKERNSEC_CHROOT_CAPS Related sysctl variables:
    kernel.grsecurity.chroot_caps

#### Exempt initrd tasks from restrictions

GRKERNSEC_CHROOT_INITRD

### Kernel Auditing
#### Single group for auditing

GRKERNSEC_AUDIT_GROUP Related sysctl variables:
    kernel.grsecurity.audit_gid
    kernel.grsecurity.audit_group

#### GID for auditing

GRKERNSEC_AUDIT_GID

#### Exec logging

GRKERNSEC_EXECLOG Related sysctl variables:
    kernel.grsecurity.exec_logging

#### Resource logging

GRKERNSEC_RESLOG Related sysctl variables:
    kernel.grsecurity.resource_logging

#### Log execs within chroot

GRKERNSEC_CHROOT_EXECLOG Related sysctl variables:
    kernel.grsecurity.chroot_execlog

#### Ptrace logging

GRKERNSEC_AUDIT_PTRACE Related sysctl variables:
    kernel.grsecurity.audit_ptrace

#### Chdir logging

GRKERNSEC_AUDIT_CHDIR Related sysctl variables:
    kernel.grsecurity.audit_chdir

#### (Un)Mount logging

GRKERNSEC_AUDIT_MOUNT Related sysctl variables:
    kernel.grsecurity.audit_mount

#### Signal logging

GRKERNSEC_SIGNAL Related sysctl variables:
    kernel.grsecurity.signal_logging

#### Fork failure logging

GRKERNSEC_FORKFAIL Related sysctl variables:
    kernel.grsecurity.forkfail_logging

#### Time change logging

GRKERNSEC_TIME Related sysctl variables:
    kernel.grsecurity.timechange_logging

#### /proc/<pid>/ipaddr support

GRKERNSEC_PROC_IPADDR

#### Denied RWX mmap/mprotect logging

GRKERNSEC_RWXMAP_LOG Related sysctl variables:
    kernel.grsecurity.rwxmap_logging

### Executable Protections
#### Dmesg(8) restriction

GRKERNSEC_DMESG Related sysctl variables:
    kernel.grsecurity.dmesg

#### Deter ptrace-based process snooping

GRKERNSEC_HARDEN_PTRACE Related sysctl variables:
    kernel.grsecurity.harden_ptrace

#### Require read access to ptrace sensitive binaries

GRKERNSEC_PTRACE_READEXEC Related sysctl variables:
    kernel.grsecurity.ptrace_readexec

#### Enforce consistent multithreaded privileges

GRKERNSEC_SETXID Related sysctl variables:
    kernel.grsecurity.consistent_setxid

#### Disallow access to overly-permissive IPC objects

GRKERNSEC_HARDEN_IPC Related sysctl variables:
    kernel.grsecurity.harden_ipc

#### Trusted Path Execution (TPE)

GRKERNSEC_TPE Related sysctl variables:
    kernel.grsecurity.tpe
    kernel.grsecurity.tpe_gid

#### Partially restrict all non-root users

GRKERNSEC_TPE_ALL Related sysctl variables:
    kernel.grsecurity.tpe_restrict_all

#### Invert GID option

GRKERNSEC_TPE_INVERT Related sysctl variables:
    kernel.grsecurity.tpe_invert

#### GID for TPE-untrusted users

GRKERNSEC_TPE_UNTRUSTED_GID

#### GID for TPE-trusted users

GRKERNSEC_TPE_TRUSTED_GID

### Network Protections
#### Larger entropy pools

GRKERNSEC_RANDNET

#### TCP/UDP blackhole and LAST_ACK DoS prevention

GRKERNSEC_BLACKHOLE Related sysctl variables:
    kernel.grsecurity.ip_blackhole
    kernel.grsecurity.lastack_retries

#### Disable TCP Simultaneous Connect

GRKERNSEC_NO_SIMULT_CONNECT

#### Socket restrictions

GRKERNSEC_SOCKET

#### Deny any sockets to group

GRKERNSEC_SOCKET_ALL Related sysctl variables:
    kernel.grsecurity.socket_all
    kernel.grsecurity.socket_all_gid

#### GID to deny all sockets for

GRKERNSEC_SOCKET_ALL_GID

#### Deny client sockets to group

GRKERNSEC_SOCKET_CLIENT Related sysctl variables:
    kernel.grsecurity.socket_client
    kernel.grsecurity.socket_client_gid

#### GID to deny client sockets for

GRKERNSEC_SOCKET_CLIENT_GID

#### Deny server sockets to group

GRKERNSEC_SOCKET_SERVER Related sysctl variables:
    kernel.grsecurity.socket_server
    kernel.grsecurity.socket_server_gid

#### GID to deny server sockets for

GRKERNSEC_SOCKET_SERVER_GID

### Physical Protections
#### Deny new USB connections after toggle

GRKERNSEC_DENYUSB Related sysctl variables:
    kernel.grsecurity.deny_new_usb

#### Reject all USB devices not connected at boot

GRKERNSEC_DENYUSB_FORCE

### Sysctl Support
#### Sysctl support

GRKERNSEC_SYSCTL

#### Extra sysctl support for distro makers (READ HELP)

GRKERNSEC_SYSCTL_DISTRO

#### Turn on features by default

GRKERNSEC_SYSCTL_ON

### Logging Options
#### Seconds in between log messages (minimum)

GRKERNSEC_FLOODTIME

#### Number of messages in a burst (maximum)

GRKERNSEC_FLOODBURST