Commit | Line | Data |
---|---|---|
ec8f24b7 | 1 | # SPDX-License-Identifier: GPL-2.0-only |
f381c272 MZ |
2 | # |
3 | config INTEGRITY | |
7ef84e65 DK |
4 | bool "Integrity subsystem" |
5 | depends on SECURITY | |
6 | default y | |
7 | help | |
8 | This option enables the integrity subsystem, which is comprised | |
9 | of a number of different components including the Integrity | |
10 | Measurement Architecture (IMA), Extended Verification Module | |
11 | (EVM), IMA-appraisal extension, digital signature verification | |
12 | extension and audit measurement log support. | |
13 | ||
14 | Each of these components can be enabled/disabled separately. | |
15 | Refer to the individual components for additional details. | |
16 | ||
17 | if INTEGRITY | |
f381c272 | 18 | |
f1be242c | 19 | config INTEGRITY_SIGNATURE |
6341e62b | 20 | bool "Digital signature verification using multiple keyrings" |
8607c501 | 21 | default n |
cf38fed1 | 22 | select KEYS |
5e8898e9 | 23 | select SIGNATURE |
8607c501 DK |
24 | help |
25 | This option enables digital signature verification support | |
26 | using multiple keyrings. It defines separate keyrings for each | |
27 | of the different use cases - evm, ima, and modules. | |
28 | Different keyrings improves search performance, but also allow | |
29 | to "lock" certain keyring to prevent adding new keys. | |
30 | This is useful for evm and module keyrings, when keys are | |
31 | usually only added from initramfs. | |
32 | ||
1ae8f41c | 33 | config INTEGRITY_ASYMMETRIC_KEYS |
6341e62b | 34 | bool "Enable asymmetric keys support" |
1ae8f41c DK |
35 | depends on INTEGRITY_SIGNATURE |
36 | default n | |
37 | select ASYMMETRIC_KEY_TYPE | |
38 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE | |
eb5798f2 | 39 | select CRYPTO_RSA |
1ae8f41c DK |
40 | select X509_CERTIFICATE_PARSER |
41 | help | |
42 | This option enables digital signature verification using | |
43 | asymmetric keys. | |
44 | ||
f4dc3778 DK |
45 | config INTEGRITY_TRUSTED_KEYRING |
46 | bool "Require all keys on the integrity keyrings be signed" | |
47 | depends on SYSTEM_TRUSTED_KEYRING | |
48 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
f4dc3778 DK |
49 | default y |
50 | help | |
51 | This option requires that all keys added to the .ima and | |
52 | .evm keyrings be signed by a key on the system trusted | |
53 | keyring. | |
54 | ||
9dc92c45 NJ |
55 | config INTEGRITY_PLATFORM_KEYRING |
56 | bool "Provide keyring for platform/firmware trusted keys" | |
57 | depends on INTEGRITY_ASYMMETRIC_KEYS | |
58 | depends on SYSTEM_BLACKLIST_KEYRING | |
9dc92c45 NJ |
59 | help |
60 | Provide a separate, distinct keyring for platform trusted keys, which | |
61 | the kernel automatically populates during initialization from values | |
62 | provided by the platform for verifying the kexec'ed kerned image | |
63 | and, possibly, the initramfs signature. | |
64 | ||
9641b8cc MS |
65 | config LOAD_UEFI_KEYS |
66 | depends on INTEGRITY_PLATFORM_KEYRING | |
67 | depends on EFI | |
68 | def_bool y | |
69 | ||
70 | config LOAD_IPL_KEYS | |
71 | depends on INTEGRITY_PLATFORM_KEYRING | |
72 | depends on S390 | |
73 | def_bool y | |
74 | ||
8220e22d NJ |
75 | config LOAD_PPC_KEYS |
76 | bool "Enable loading of platform and blacklisted keys for POWER" | |
77 | depends on INTEGRITY_PLATFORM_KEYRING | |
78 | depends on PPC_SECURE_BOOT | |
79 | default y | |
80 | help | |
81 | Enable loading of keys to the .platform keyring and blacklisted | |
82 | hashes to the .blacklist keyring for powerpc based platforms. | |
83 | ||
d726d8d7 MZ |
84 | config INTEGRITY_AUDIT |
85 | bool "Enables integrity auditing support " | |
7ef84e65 | 86 | depends on AUDIT |
d726d8d7 MZ |
87 | default y |
88 | help | |
89 | In addition to enabling integrity auditing support, this | |
90 | option adds a kernel parameter 'integrity_audit', which | |
91 | controls the level of integrity auditing messages. | |
92 | 0 - basic integrity auditing messages (default) | |
93 | 1 - additional integrity auditing messages | |
94 | ||
95 | Additional informational integrity auditing messages would | |
96 | be enabled by specifying 'integrity_audit=1' on the kernel | |
97 | command line. | |
98 | ||
8636a1f9 MY |
99 | source "security/integrity/ima/Kconfig" |
100 | source "security/integrity/evm/Kconfig" | |
7ef84e65 DK |
101 | |
102 | endif # if INTEGRITY |