Commit | Line | Data |
---|---|---|
ec8f24b7 | 1 | # SPDX-License-Identifier: GPL-2.0-only |
f0894940 DH |
2 | # |
3 | # Key management configuration | |
4 | # | |
5 | ||
6 | config KEYS | |
7 | bool "Enable access key retention support" | |
b2a4df20 | 8 | select ASSOCIATIVE_ARRAY |
f0894940 DH |
9 | help |
10 | This option provides support for retaining authentication tokens and | |
11 | access keys in the kernel. | |
12 | ||
13 | It also includes provision of methods by which such keys might be | |
14 | associated with a process so that network filesystems, encryption | |
15 | support and the like can find them. | |
16 | ||
17 | Furthermore, a special type of key is available that acts as keyring: | |
18 | a searchable sequence of keys. Each process is equipped with access | |
19 | to five standard keyrings: UID-specific, GID-specific, session, | |
20 | process and thread. | |
21 | ||
22 | If you are unsure as to whether this is required, answer N. | |
23 | ||
7743c48e DH |
24 | config KEYS_REQUEST_CACHE |
25 | bool "Enable temporary caching of the last request_key() result" | |
26 | depends on KEYS | |
27 | help | |
28 | This option causes the result of the last successful request_key() | |
29 | call that didn't upcall to the kernel to be cached temporarily in the | |
30 | task_struct. The cache is cleared by exit and just prior to the | |
31 | resumption of userspace. | |
32 | ||
33 | This allows the key used for multiple step processes where each step | |
34 | wants to request a key that is likely the same as the one requested | |
35 | by the last step to save on the searching. | |
36 | ||
37 | An example of such a process is a pathwalk through a network | |
38 | filesystem in which each method needs to request an authentication | |
39 | key. Pathwalk will call multiple methods for each dentry traversed | |
40 | (permission, d_revalidate, lookup, getxattr, getacl, ...). | |
41 | ||
f36f8c75 DH |
42 | config PERSISTENT_KEYRINGS |
43 | bool "Enable register of persistent per-UID keyrings" | |
44 | depends on KEYS | |
45 | help | |
46 | This option provides a register of persistent per-UID keyrings, | |
47 | primarily aimed at Kerberos key storage. The keyrings are persistent | |
48 | in the sense that they stay around after all processes of that UID | |
49 | have exited, not that they survive the machine being rebooted. | |
50 | ||
51 | A particular keyring may be accessed by either the user whose keyring | |
52 | it is or by a process with administrative privileges. The active | |
53 | LSMs gets to rule on which admin-level processes get to access the | |
54 | cache. | |
55 | ||
56 | Keyrings are created and added into the register upon demand and get | |
57 | removed if they expire (a default timeout is set upon creation). | |
58 | ||
ab3c3587 | 59 | config BIG_KEYS |
2eaf6b5d | 60 | bool "Large payload keys" |
ab3c3587 DH |
61 | depends on KEYS |
62 | depends on TMPFS | |
521fd61c | 63 | depends on CRYPTO_LIB_CHACHA20POLY1305 = y |
ab3c3587 DH |
64 | help |
65 | This option provides support for holding large keys within the kernel | |
66 | (for example Kerberos ticket caches). The data may be stored out to | |
67 | swapspace by tmpfs. | |
68 | ||
69 | If you are unsure as to whether this is required, answer N. | |
70 | ||
f0894940 DH |
71 | config TRUSTED_KEYS |
72 | tristate "TRUSTED KEYS" | |
be07858f | 73 | depends on KEYS |
f0894940 DH |
74 | help |
75 | This option provides support for creating, sealing, and unsealing | |
76 | keys in the kernel. Trusted keys are random number symmetric keys, | |
be07858f AF |
77 | generated and sealed by a trust source selected at kernel boot-time. |
78 | Userspace will only ever see encrypted blobs. | |
f0894940 DH |
79 | |
80 | If you are unsure as to whether this is required, answer N. | |
81 | ||
be07858f AF |
82 | if TRUSTED_KEYS |
83 | source "security/keys/trusted-keys/Kconfig" | |
84 | endif | |
85 | ||
f0894940 DH |
86 | config ENCRYPTED_KEYS |
87 | tristate "ENCRYPTED KEYS" | |
88 | depends on KEYS | |
89 | select CRYPTO | |
90 | select CRYPTO_HMAC | |
91 | select CRYPTO_AES | |
92 | select CRYPTO_CBC | |
93 | select CRYPTO_SHA256 | |
94 | select CRYPTO_RNG | |
95 | help | |
96 | This option provides support for create/encrypting/decrypting keys | |
cd3bc044 YT |
97 | in the kernel. Encrypted keys are instantiated using kernel |
98 | generated random numbers or provided decrypted data, and are | |
99 | encrypted/decrypted with a 'master' symmetric key. The 'master' | |
100 | key can be either a trusted-key or user-key type. Only encrypted | |
101 | blobs are ever output to Userspace. | |
102 | ||
103 | If you are unsure as to whether this is required, answer N. | |
104 | ||
105 | config USER_DECRYPTED_DATA | |
106 | bool "Allow encrypted keys with user decrypted data" | |
107 | depends on ENCRYPTED_KEYS | |
108 | help | |
109 | This option provides support for instantiating encrypted keys using | |
110 | user-provided decrypted data. The decrypted data must be hex-ascii | |
111 | encoded. | |
f0894940 DH |
112 | |
113 | If you are unsure as to whether this is required, answer N. | |
ddbb4114 MM |
114 | |
115 | config KEY_DH_OPERATIONS | |
116 | bool "Diffie-Hellman operations on retained keys" | |
117 | depends on KEYS | |
4cd4ca7c | 118 | select CRYPTO |
d3b04a43 | 119 | select CRYPTO_KDF800108_CTR |
7cbe0932 | 120 | select CRYPTO_DH |
ddbb4114 MM |
121 | help |
122 | This option provides support for calculating Diffie-Hellman | |
123 | public keys and shared secrets using values stored as keys | |
124 | in the kernel. | |
125 | ||
126 | If you are unsure as to whether this is required, answer N. | |
f7e47677 DH |
127 | |
128 | config KEY_NOTIFICATIONS | |
129 | bool "Provide key/keyring change notifications" | |
130 | depends on KEYS && WATCH_QUEUE | |
131 | help | |
8fe62e0c GKB |
132 | This option provides support for getting change notifications |
133 | on keys and keyrings on which the caller has View permission. | |
134 | This makes use of pipes to handle the notification buffer and | |
135 | provides KEYCTL_WATCH_KEY to enable/disable watches. |