Commit | Line | Data |
---|---|---|
b2441318 | 1 | # SPDX-License-Identifier: GPL-2.0 |
cfc411e7 DH |
2 | menu "Certificates for signature checking" |
3 | ||
4 | config MODULE_SIG_KEY | |
5 | string "File name or PKCS#11 URI of module signing key" | |
6 | default "certs/signing_key.pem" | |
781a5739 | 7 | depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) |
cfc411e7 DH |
8 | help |
9 | Provide the file name of a private key/certificate in PEM format, | |
10 | or a PKCS#11 URI according to RFC7512. The file should contain, or | |
11 | the URI should identify, both the certificate and its corresponding | |
12 | private key. | |
13 | ||
14 | If this option is unchanged from its default "certs/signing_key.pem", | |
15 | then the kernel will automatically generate the private key and | |
5fb94e9c | 16 | certificate as described in Documentation/admin-guide/module-signing.rst |
cfc411e7 | 17 | |
a4aed36e SB |
18 | choice |
19 | prompt "Type of module signing key to be generated" | |
20 | default MODULE_SIG_KEY_TYPE_RSA | |
21 | help | |
22 | The type of module signing key type to generate. This option | |
23 | does not apply if a #PKCS11 URI is used. | |
24 | ||
25 | config MODULE_SIG_KEY_TYPE_RSA | |
26 | bool "RSA" | |
27 | depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) | |
28 | help | |
29 | Use an RSA key for module signing. | |
30 | ||
31 | config MODULE_SIG_KEY_TYPE_ECDSA | |
32 | bool "ECDSA" | |
33 | select CRYPTO_ECDSA | |
34 | depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) | |
35 | help | |
36 | Use an elliptic curve key (NIST P384) for module signing. Consider | |
37 | using a strong hash like sha256 or sha384 for hashing modules. | |
38 | ||
39 | Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem, | |
40 | when falling back to building Linux 5.14 and older kernels. | |
41 | ||
42 | endchoice | |
43 | ||
cfc411e7 DH |
44 | config SYSTEM_TRUSTED_KEYRING |
45 | bool "Provide system-wide ring of trusted keys" | |
46 | depends on KEYS | |
99716b7c | 47 | depends on ASYMMETRIC_KEY_TYPE |
cfc411e7 DH |
48 | help |
49 | Provide a system keyring to which trusted keys can be added. Keys in | |
50 | the keyring are considered to be trusted. Keys may be added at will | |
51 | by the kernel from compiled-in data and from hardware key stores, but | |
52 | userspace may only add extra keys if those keys can be verified by | |
53 | keys already in the keyring. | |
54 | ||
55 | Keys in this keyring are used by module signature checking. | |
56 | ||
57 | config SYSTEM_TRUSTED_KEYS | |
58 | string "Additional X.509 keys for default system keyring" | |
59 | depends on SYSTEM_TRUSTED_KEYRING | |
60 | help | |
61 | If set, this option should be the filename of a PEM-formatted file | |
62 | containing trusted X.509 certificates to be included in the default | |
63 | system keyring. Any certificate used for module signing is implicitly | |
64 | also trusted. | |
65 | ||
66 | NOTE: If you previously provided keys for the system keyring in the | |
67 | form of DER-encoded *.x509 files in the top-level build directory, | |
68 | those are no longer used. You will need to set this option instead. | |
69 | ||
c4c36105 MK |
70 | config SYSTEM_EXTRA_CERTIFICATE |
71 | bool "Reserve area for inserting a certificate without recompiling" | |
72 | depends on SYSTEM_TRUSTED_KEYRING | |
73 | help | |
74 | If set, space for an extra certificate will be reserved in the kernel | |
75 | image. This allows introducing a trusted certificate to the default | |
76 | system keyring without recompiling the kernel. | |
77 | ||
78 | config SYSTEM_EXTRA_CERTIFICATE_SIZE | |
79 | int "Number of bytes to reserve for the extra certificate" | |
80 | depends on SYSTEM_EXTRA_CERTIFICATE | |
81 | default 4096 | |
82 | help | |
83 | This is the number of bytes reserved in the kernel image for a | |
84 | certificate to be inserted. | |
85 | ||
d3bfe841 DH |
86 | config SECONDARY_TRUSTED_KEYRING |
87 | bool "Provide a keyring to which extra trustable keys may be added" | |
88 | depends on SYSTEM_TRUSTED_KEYRING | |
89 | help | |
90 | If set, provide a keyring to which extra keys may be added, provided | |
91 | those keys are not blacklisted and are vouched for by a key built | |
92 | into the kernel or already in the secondary trusted keyring. | |
93 | ||
734114f8 DH |
94 | config SYSTEM_BLACKLIST_KEYRING |
95 | bool "Provide system-wide ring of blacklisted keys" | |
96 | depends on KEYS | |
97 | help | |
98 | Provide a system keyring to which blacklisted keys can be added. | |
99 | Keys in the keyring are considered entirely untrusted. Keys in this | |
100 | keyring are used by the module signature checking to reject loading | |
101 | of modules signed with a blacklisted key. | |
102 | ||
103 | config SYSTEM_BLACKLIST_HASH_LIST | |
104 | string "Hashes to be preloaded into the system blacklist keyring" | |
105 | depends on SYSTEM_BLACKLIST_KEYRING | |
106 | help | |
107 | If set, this option should be the filename of a list of hashes in the | |
108 | form "<hash>", "<hash>", ... . This will be included into a C | |
109 | wrapper to incorporate the list into the kernel. Each <hash> should | |
110 | be a string of hex digits. | |
111 | ||
56c58126 ES |
112 | config SYSTEM_REVOCATION_LIST |
113 | bool "Provide system-wide ring of revocation certificates" | |
114 | depends on SYSTEM_BLACKLIST_KEYRING | |
115 | depends on PKCS7_MESSAGE_PARSER=y | |
116 | help | |
117 | If set, this allows revocation certificates to be stored in the | |
118 | blacklist keyring and implements a hook whereby a PKCS#7 message can | |
119 | be checked to see if it matches such a certificate. | |
120 | ||
d1f04410 ES |
121 | config SYSTEM_REVOCATION_KEYS |
122 | string "X.509 certificates to be preloaded into the system blacklist keyring" | |
123 | depends on SYSTEM_REVOCATION_LIST | |
124 | help | |
125 | If set, this option should be the filename of a PEM-formatted file | |
126 | containing X.509 certificates to be included in the default blacklist | |
127 | keyring. | |
128 | ||
cfc411e7 | 129 | endmenu |