projects / linux-2.6-block.git / blame
| Commit | Line | Data |
|---|---|---|
| ec8f24b7 | 1 | # SPDX-License-Identifier: GPL-2.0-only |
| f0894940 DH |
2 | # |
| 3 | # Key management configuration | |
| 4 | # | |
| 5 | ||
| 6 | config KEYS | |
| 7 | bool "Enable access key retention support" | |
| b2a4df20 | 8 | select ASSOCIATIVE_ARRAY |
| f0894940 DH |
9 | help |
| 10 | This option provides support for retaining authentication tokens and | |
| 11 | access keys in the kernel. | |
| 12 | ||
| 13 | It also includes provision of methods by which such keys might be | |
| 14 | associated with a process so that network filesystems, encryption | |
| 15 | support and the like can find them. | |
| 16 | ||
| 17 | Furthermore, a special type of key is available that acts as keyring: | |
| 18 | a searchable sequence of keys. Each process is equipped with access | |
| 19 | to five standard keyrings: UID-specific, GID-specific, session, | |
| 20 | process and thread. | |
| 21 | ||
| 22 | If you are unsure as to whether this is required, answer N. | |
| 23 | ||
| 47b2c3ff BA |
24 | config KEYS_COMPAT |
| 25 | def_bool y | |
| 26 | depends on COMPAT && KEYS | |
| 27 | ||
| 7743c48e DH |
28 | config KEYS_REQUEST_CACHE |
| 29 | bool "Enable temporary caching of the last request_key() result" | |
| 30 | depends on KEYS | |
| 31 | help | |
| 32 | This option causes the result of the last successful request_key() | |
| 33 | call that didn't upcall to the kernel to be cached temporarily in the | |
| 34 | task_struct. The cache is cleared by exit and just prior to the | |
| 35 | resumption of userspace. | |
| 36 | ||
| 37 | This allows the key used for multiple step processes where each step | |
| 38 | wants to request a key that is likely the same as the one requested | |
| 39 | by the last step to save on the searching. | |
| 40 | ||
| 41 | An example of such a process is a pathwalk through a network | |
| 42 | filesystem in which each method needs to request an authentication | |
| 43 | key. Pathwalk will call multiple methods for each dentry traversed | |
| 44 | (permission, d_revalidate, lookup, getxattr, getacl, ...). | |
| 45 | ||
| f36f8c75 DH |
46 | config PERSISTENT_KEYRINGS |
| 47 | bool "Enable register of persistent per-UID keyrings" | |
| 48 | depends on KEYS | |
| 49 | help | |
| 50 | This option provides a register of persistent per-UID keyrings, | |
| 51 | primarily aimed at Kerberos key storage. The keyrings are persistent | |
| 52 | in the sense that they stay around after all processes of that UID | |
| 53 | have exited, not that they survive the machine being rebooted. | |
| 54 | ||
| 55 | A particular keyring may be accessed by either the user whose keyring | |
| 56 | it is or by a process with administrative privileges. The active | |
| 57 | LSMs gets to rule on which admin-level processes get to access the | |
| 58 | cache. | |
| 59 | ||
| 60 | Keyrings are created and added into the register upon demand and get | |
| 61 | removed if they expire (a default timeout is set upon creation). | |
| 62 | ||
| ab3c3587 | 63 | config BIG_KEYS |
| 2eaf6b5d | 64 | bool "Large payload keys" |
| ab3c3587 DH |
65 | depends on KEYS |
| 66 | depends on TMPFS | |
| 3cd18d19 | 67 | select CRYPTO |
| 13100a72 | 68 | select CRYPTO_AES |
| 428490e3 | 69 | select CRYPTO_GCM |
| ab3c3587 DH |
70 | help |
| 71 | This option provides support for holding large keys within the kernel | |
| 72 | (for example Kerberos ticket caches). The data may be stored out to | |
| 73 | swapspace by tmpfs. | |
| 74 | ||
| 75 | If you are unsure as to whether this is required, answer N. | |
| 76 | ||
| f0894940 DH |
77 | config TRUSTED_KEYS |
| 78 | tristate "TRUSTED KEYS" | |
| 79 | depends on KEYS && TCG_TPM | |
| 80 | select CRYPTO | |
| 81 | select CRYPTO_HMAC | |
| 82 | select CRYPTO_SHA1 | |
| 5ca4c20c | 83 | select CRYPTO_HASH_INFO |
| f0894940 DH |
84 | help |
| 85 | This option provides support for creating, sealing, and unsealing | |
| 86 | keys in the kernel. Trusted keys are random number symmetric keys, | |
| 87 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, | |
| 88 | if the boot PCRs and other criteria match. Userspace will only ever | |
| 89 | see encrypted blobs. | |
| 90 | ||
| 91 | If you are unsure as to whether this is required, answer N. | |
| 92 | ||
| 93 | config ENCRYPTED_KEYS | |
| 94 | tristate "ENCRYPTED KEYS" | |
| 95 | depends on KEYS | |
| 96 | select CRYPTO | |
| 97 | select CRYPTO_HMAC | |
| 98 | select CRYPTO_AES | |
| 99 | select CRYPTO_CBC | |
| 100 | select CRYPTO_SHA256 | |
| 101 | select CRYPTO_RNG | |
| 102 | help | |
| 103 | This option provides support for create/encrypting/decrypting keys | |
| 104 | in the kernel. Encrypted keys are kernel generated random numbers, | |
| 105 | which are encrypted/decrypted with a 'master' symmetric key. The | |
| 106 | 'master' key can be either a trusted-key or user-key type. | |
| 107 | Userspace only ever sees/stores encrypted blobs. | |
| 108 | ||
| 109 | If you are unsure as to whether this is required, answer N. | |
| ddbb4114 MM |
110 | |
| 111 | config KEY_DH_OPERATIONS | |
| 112 | bool "Diffie-Hellman operations on retained keys" | |
| 113 | depends on KEYS | |
| 4cd4ca7c | 114 | select CRYPTO |
| f1c316a3 | 115 | select CRYPTO_HASH |
| 7cbe0932 | 116 | select CRYPTO_DH |
| ddbb4114 MM |
117 | help |
| 118 | This option provides support for calculating Diffie-Hellman | |
| 119 | public keys and shared secrets using values stored as keys | |
| 120 | in the kernel. | |
| 121 | ||
| 122 | If you are unsure as to whether this is required, answer N. |