Commit | Line | Data |
---|---|---|
b2441318 | 1 | # SPDX-License-Identifier: GPL-2.0 |
cfc411e7 DH |
2 | menu "Certificates for signature checking" |
3 | ||
4 | config MODULE_SIG_KEY | |
5 | string "File name or PKCS#11 URI of module signing key" | |
6 | default "certs/signing_key.pem" | |
781a5739 | 7 | depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) |
cfc411e7 DH |
8 | help |
9 | Provide the file name of a private key/certificate in PEM format, | |
10 | or a PKCS#11 URI according to RFC7512. The file should contain, or | |
11 | the URI should identify, both the certificate and its corresponding | |
12 | private key. | |
13 | ||
14 | If this option is unchanged from its default "certs/signing_key.pem", | |
15 | then the kernel will automatically generate the private key and | |
5fb94e9c | 16 | certificate as described in Documentation/admin-guide/module-signing.rst |
cfc411e7 | 17 | |
a4aed36e SB |
18 | choice |
19 | prompt "Type of module signing key to be generated" | |
be0d5fa7 | 20 | depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) |
a4aed36e SB |
21 | help |
22 | The type of module signing key type to generate. This option | |
23 | does not apply if a #PKCS11 URI is used. | |
24 | ||
25 | config MODULE_SIG_KEY_TYPE_RSA | |
26 | bool "RSA" | |
a4aed36e SB |
27 | help |
28 | Use an RSA key for module signing. | |
29 | ||
30 | config MODULE_SIG_KEY_TYPE_ECDSA | |
31 | bool "ECDSA" | |
32 | select CRYPTO_ECDSA | |
a4aed36e SB |
33 | help |
34 | Use an elliptic curve key (NIST P384) for module signing. Consider | |
35 | using a strong hash like sha256 or sha384 for hashing modules. | |
36 | ||
37 | Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem, | |
38 | when falling back to building Linux 5.14 and older kernels. | |
39 | ||
40 | endchoice | |
41 | ||
cfc411e7 DH |
42 | config SYSTEM_TRUSTED_KEYRING |
43 | bool "Provide system-wide ring of trusted keys" | |
44 | depends on KEYS | |
99716b7c | 45 | depends on ASYMMETRIC_KEY_TYPE |
cfc411e7 DH |
46 | help |
47 | Provide a system keyring to which trusted keys can be added. Keys in | |
48 | the keyring are considered to be trusted. Keys may be added at will | |
49 | by the kernel from compiled-in data and from hardware key stores, but | |
50 | userspace may only add extra keys if those keys can be verified by | |
51 | keys already in the keyring. | |
52 | ||
53 | Keys in this keyring are used by module signature checking. | |
54 | ||
55 | config SYSTEM_TRUSTED_KEYS | |
56 | string "Additional X.509 keys for default system keyring" | |
57 | depends on SYSTEM_TRUSTED_KEYRING | |
58 | help | |
59 | If set, this option should be the filename of a PEM-formatted file | |
60 | containing trusted X.509 certificates to be included in the default | |
61 | system keyring. Any certificate used for module signing is implicitly | |
62 | also trusted. | |
63 | ||
64 | NOTE: If you previously provided keys for the system keyring in the | |
65 | form of DER-encoded *.x509 files in the top-level build directory, | |
66 | those are no longer used. You will need to set this option instead. | |
67 | ||
c4c36105 MK |
68 | config SYSTEM_EXTRA_CERTIFICATE |
69 | bool "Reserve area for inserting a certificate without recompiling" | |
70 | depends on SYSTEM_TRUSTED_KEYRING | |
71 | help | |
72 | If set, space for an extra certificate will be reserved in the kernel | |
73 | image. This allows introducing a trusted certificate to the default | |
74 | system keyring without recompiling the kernel. | |
75 | ||
76 | config SYSTEM_EXTRA_CERTIFICATE_SIZE | |
77 | int "Number of bytes to reserve for the extra certificate" | |
78 | depends on SYSTEM_EXTRA_CERTIFICATE | |
79 | default 4096 | |
80 | help | |
81 | This is the number of bytes reserved in the kernel image for a | |
82 | certificate to be inserted. | |
83 | ||
d3bfe841 DH |
84 | config SECONDARY_TRUSTED_KEYRING |
85 | bool "Provide a keyring to which extra trustable keys may be added" | |
86 | depends on SYSTEM_TRUSTED_KEYRING | |
87 | help | |
88 | If set, provide a keyring to which extra keys may be added, provided | |
89 | those keys are not blacklisted and are vouched for by a key built | |
90 | into the kernel or already in the secondary trusted keyring. | |
91 | ||
734114f8 DH |
92 | config SYSTEM_BLACKLIST_KEYRING |
93 | bool "Provide system-wide ring of blacklisted keys" | |
94 | depends on KEYS | |
95 | help | |
96 | Provide a system keyring to which blacklisted keys can be added. | |
97 | Keys in the keyring are considered entirely untrusted. Keys in this | |
98 | keyring are used by the module signature checking to reject loading | |
99 | of modules signed with a blacklisted key. | |
100 | ||
101 | config SYSTEM_BLACKLIST_HASH_LIST | |
102 | string "Hashes to be preloaded into the system blacklist keyring" | |
103 | depends on SYSTEM_BLACKLIST_KEYRING | |
104 | help | |
105 | If set, this option should be the filename of a list of hashes in the | |
106 | form "<hash>", "<hash>", ... . This will be included into a C | |
addf4663 MS |
107 | wrapper to incorporate the list into the kernel. Each <hash> must be a |
108 | string starting with a prefix ("tbs" or "bin"), then a colon (":"), and | |
109 | finally an even number of hexadecimal lowercase characters (up to 128). | |
110 | Certificate hashes can be generated with | |
111 | tools/certs/print-cert-tbs-hash.sh . | |
734114f8 | 112 | |
56c58126 ES |
113 | config SYSTEM_REVOCATION_LIST |
114 | bool "Provide system-wide ring of revocation certificates" | |
115 | depends on SYSTEM_BLACKLIST_KEYRING | |
116 | depends on PKCS7_MESSAGE_PARSER=y | |
117 | help | |
118 | If set, this allows revocation certificates to be stored in the | |
119 | blacklist keyring and implements a hook whereby a PKCS#7 message can | |
120 | be checked to see if it matches such a certificate. | |
121 | ||
d1f04410 ES |
122 | config SYSTEM_REVOCATION_KEYS |
123 | string "X.509 certificates to be preloaded into the system blacklist keyring" | |
124 | depends on SYSTEM_REVOCATION_LIST | |
125 | help | |
126 | If set, this option should be the filename of a PEM-formatted file | |
127 | containing X.509 certificates to be included in the default blacklist | |
128 | keyring. | |
129 | ||
6364d106 MS |
130 | config SYSTEM_BLACKLIST_AUTH_UPDATE |
131 | bool "Allow root to add signed blacklist keys" | |
132 | depends on SYSTEM_BLACKLIST_KEYRING | |
133 | depends on SYSTEM_DATA_VERIFICATION | |
134 | help | |
135 | If set, provide the ability to load new blacklist keys at run time if | |
136 | they are signed and vouched by a certificate from the builtin trusted | |
137 | keyring. The PKCS#7 signature of the description is set in the key | |
138 | payload. Blacklist keys cannot be removed. | |
139 | ||
cfc411e7 | 140 | endmenu |