Commit | Line | Data |
---|---|---|
f381c272 MZ |
1 | # |
2 | config INTEGRITY | |
7ef84e65 DK |
3 | bool "Integrity subsystem" |
4 | depends on SECURITY | |
5 | default y | |
6 | help | |
7 | This option enables the integrity subsystem, which is comprised | |
8 | of a number of different components including the Integrity | |
9 | Measurement Architecture (IMA), Extended Verification Module | |
10 | (EVM), IMA-appraisal extension, digital signature verification | |
11 | extension and audit measurement log support. | |
12 | ||
13 | Each of these components can be enabled/disabled separately. | |
14 | Refer to the individual components for additional details. | |
15 | ||
16 | if INTEGRITY | |
f381c272 | 17 | |
f1be242c | 18 | config INTEGRITY_SIGNATURE |
6341e62b | 19 | bool "Digital signature verification using multiple keyrings" |
7ef84e65 | 20 | depends on KEYS |
8607c501 | 21 | default n |
5e8898e9 | 22 | select SIGNATURE |
8607c501 DK |
23 | help |
24 | This option enables digital signature verification support | |
25 | using multiple keyrings. It defines separate keyrings for each | |
26 | of the different use cases - evm, ima, and modules. | |
27 | Different keyrings improves search performance, but also allow | |
28 | to "lock" certain keyring to prevent adding new keys. | |
29 | This is useful for evm and module keyrings, when keys are | |
30 | usually only added from initramfs. | |
31 | ||
1ae8f41c | 32 | config INTEGRITY_ASYMMETRIC_KEYS |
6341e62b | 33 | bool "Enable asymmetric keys support" |
1ae8f41c DK |
34 | depends on INTEGRITY_SIGNATURE |
35 | default n | |
36 | select ASYMMETRIC_KEY_TYPE | |
37 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE | |
eb5798f2 | 38 | select CRYPTO_RSA |
1ae8f41c DK |
39 | select X509_CERTIFICATE_PARSER |
40 | help | |
41 | This option enables digital signature verification using | |
42 | asymmetric keys. | |
43 | ||
f4dc3778 DK |
44 | config INTEGRITY_TRUSTED_KEYRING |
45 | bool "Require all keys on the integrity keyrings be signed" | |
46 | depends on SYSTEM_TRUSTED_KEYRING | |
47 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
f4dc3778 DK |
48 | default y |
49 | help | |
50 | This option requires that all keys added to the .ima and | |
51 | .evm keyrings be signed by a key on the system trusted | |
52 | keyring. | |
53 | ||
9dc92c45 NJ |
54 | config INTEGRITY_PLATFORM_KEYRING |
55 | bool "Provide keyring for platform/firmware trusted keys" | |
56 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
57 | depends on SYSTEM_BLACKLIST_KEYRING | |
58 | depends on EFI | |
59 | help | |
60 | Provide a separate, distinct keyring for platform trusted keys, which | |
61 | the kernel automatically populates during initialization from values | |
62 | provided by the platform for verifying the kexec'ed kerned image | |
63 | and, possibly, the initramfs signature. | |
64 | ||
d726d8d7 MZ |
65 | config INTEGRITY_AUDIT |
66 | bool "Enables integrity auditing support " | |
7ef84e65 | 67 | depends on AUDIT |
d726d8d7 MZ |
68 | default y |
69 | help | |
70 | In addition to enabling integrity auditing support, this | |
71 | option adds a kernel parameter 'integrity_audit', which | |
72 | controls the level of integrity auditing messages. | |
73 | 0 - basic integrity auditing messages (default) | |
74 | 1 - additional integrity auditing messages | |
75 | ||
76 | Additional informational integrity auditing messages would | |
77 | be enabled by specifying 'integrity_audit=1' on the kernel | |
78 | command line. | |
79 | ||
8636a1f9 MY |
80 | source "security/integrity/ima/Kconfig" |
81 | source "security/integrity/evm/Kconfig" | |
7ef84e65 DK |
82 | |
83 | endif # if INTEGRITY |