projects / linux-2.6-block.git / blame
| Commit | Line | Data |
|---|---|---|
| f381c272 MZ |
1 | # |
| 2 | config INTEGRITY | |
| 7ef84e65 DK |
3 | bool "Integrity subsystem" |
| 4 | depends on SECURITY | |
| 5 | default y | |
| 6 | help | |
| 7 | This option enables the integrity subsystem, which is comprised | |
| 8 | of a number of different components including the Integrity | |
| 9 | Measurement Architecture (IMA), Extended Verification Module | |
| 10 | (EVM), IMA-appraisal extension, digital signature verification | |
| 11 | extension and audit measurement log support. | |
| 12 | ||
| 13 | Each of these components can be enabled/disabled separately. | |
| 14 | Refer to the individual components for additional details. | |
| 15 | ||
| 16 | if INTEGRITY | |
| f381c272 | 17 | |
| f1be242c | 18 | config INTEGRITY_SIGNATURE |
| 6341e62b | 19 | bool "Digital signature verification using multiple keyrings" |
| 7ef84e65 | 20 | depends on KEYS |
| 8607c501 | 21 | default n |
| 5e8898e9 | 22 | select SIGNATURE |
| 8607c501 DK |
23 | help |
| 24 | This option enables digital signature verification support | |
| 25 | using multiple keyrings. It defines separate keyrings for each | |
| 26 | of the different use cases - evm, ima, and modules. | |
| 27 | Different keyrings improves search performance, but also allow | |
| 28 | to "lock" certain keyring to prevent adding new keys. | |
| 29 | This is useful for evm and module keyrings, when keys are | |
| 30 | usually only added from initramfs. | |
| 31 | ||
| 1ae8f41c | 32 | config INTEGRITY_ASYMMETRIC_KEYS |
| 6341e62b | 33 | bool "Enable asymmetric keys support" |
| 1ae8f41c DK |
34 | depends on INTEGRITY_SIGNATURE |
| 35 | default n | |
| 36 | select ASYMMETRIC_KEY_TYPE | |
| 37 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE | |
| eb5798f2 | 38 | select CRYPTO_RSA |
| 1ae8f41c DK |
39 | select X509_CERTIFICATE_PARSER |
| 40 | help | |
| 41 | This option enables digital signature verification using | |
| 42 | asymmetric keys. | |
| 43 | ||
| f4dc3778 DK |
44 | config INTEGRITY_TRUSTED_KEYRING |
| 45 | bool "Require all keys on the integrity keyrings be signed" | |
| 46 | depends on SYSTEM_TRUSTED_KEYRING | |
| 47 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
| f4dc3778 DK |
48 | default y |
| 49 | help | |
| 50 | This option requires that all keys added to the .ima and | |
| 51 | .evm keyrings be signed by a key on the system trusted | |
| 52 | keyring. | |
| 53 | ||
| 9dc92c45 NJ |
54 | config INTEGRITY_PLATFORM_KEYRING |
| 55 | bool "Provide keyring for platform/firmware trusted keys" | |
| 56 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
| 57 | depends on SYSTEM_BLACKLIST_KEYRING | |
| 58 | depends on EFI | |
| 59 | help | |
| 60 | Provide a separate, distinct keyring for platform trusted keys, which | |
| 61 | the kernel automatically populates during initialization from values | |
| 62 | provided by the platform for verifying the kexec'ed kerned image | |
| 63 | and, possibly, the initramfs signature. | |
| 64 | ||
| d726d8d7 MZ |
65 | config INTEGRITY_AUDIT |
| 66 | bool "Enables integrity auditing support " | |
| 7ef84e65 | 67 | depends on AUDIT |
| d726d8d7 MZ |
68 | default y |
| 69 | help | |
| 70 | In addition to enabling integrity auditing support, this | |
| 71 | option adds a kernel parameter 'integrity_audit', which | |
| 72 | controls the level of integrity auditing messages. | |
| 73 | 0 - basic integrity auditing messages (default) | |
| 74 | 1 - additional integrity auditing messages | |
| 75 | ||
| 76 | Additional informational integrity auditing messages would | |
| 77 | be enabled by specifying 'integrity_audit=1' on the kernel | |
| 78 | command line. | |
| 79 | ||
| 8636a1f9 MY |
80 | source "security/integrity/ima/Kconfig" |
| 81 | source "security/integrity/evm/Kconfig" | |
| 7ef84e65 DK |
82 | |
| 83 | endif # if INTEGRITY |