| Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 1 | # |
| 2 | config INTEGRITY |
| Dmitry Kasatkin | 7ef84e6 | 2014-04-17 15:07:15 +0300 | [diff] [blame] | 3 | bool "Integrity subsystem" |
| 4 | depends on SECURITY |
| 5 | default y |
| 6 | help |
| 7 | This option enables the integrity subsystem, which is comprised |
| 8 | of a number of different components including the Integrity |
| 9 | Measurement Architecture (IMA), Extended Verification Module |
| 10 | (EVM), IMA-appraisal extension, digital signature verification |
| 11 | extension and audit measurement log support. |
| 12 | |
| 13 | Each of these components can be enabled/disabled separately. |
| 14 | Refer to the individual components for additional details. |
| 15 | |
| 16 | if INTEGRITY |
| Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 17 | |
| Dmitry Kasatkin | f1be242 | 2012-01-17 17:12:07 +0200 | [diff] [blame] | 18 | config INTEGRITY_SIGNATURE |
| Christoph Jaeger | 6341e62 | 2014-12-20 15:41:11 -0500 | [diff] [blame] | 19 | bool "Digital signature verification using multiple keyrings" |
| Dmitry Kasatkin | 7ef84e6 | 2014-04-17 15:07:15 +0300 | [diff] [blame] | 20 | depends on KEYS |
| Dmitry Kasatkin | 8607c50 | 2011-10-05 11:54:46 +0300 | [diff] [blame] | 21 | default n |
| Dmitry Kasatkin | 5e8898e | 2012-01-17 17:12:03 +0200 | [diff] [blame] | 22 | select SIGNATURE |
| Dmitry Kasatkin | 8607c50 | 2011-10-05 11:54:46 +0300 | [diff] [blame] | 23 | help |
| 24 | This option enables digital signature verification support |
| 25 | using multiple keyrings. It defines separate keyrings for each |
| 26 | of the different use cases - evm, ima, and modules. |
| 27 | Different keyrings improves search performance, but also allow |
| 28 | to "lock" certain keyring to prevent adding new keys. |
| 29 | This is useful for evm and module keyrings, when keys are |
| 30 | usually only added from initramfs. |
| 31 | |
| Dmitry Kasatkin | 1ae8f41 | 2014-04-17 14:41:06 +0300 | [diff] [blame] | 32 | config INTEGRITY_ASYMMETRIC_KEYS |
| Christoph Jaeger | 6341e62 | 2014-12-20 15:41:11 -0500 | [diff] [blame] | 33 | bool "Enable asymmetric keys support" |
| Dmitry Kasatkin | 1ae8f41 | 2014-04-17 14:41:06 +0300 | [diff] [blame] | 34 | depends on INTEGRITY_SIGNATURE |
| 35 | default n |
| 36 | select ASYMMETRIC_KEY_TYPE |
| 37 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE |
| Tadeusz Struk | eb5798f | 2016-02-02 10:08:58 -0800 | [diff] [blame] | 38 | select CRYPTO_RSA |
| Dmitry Kasatkin | 1ae8f41 | 2014-04-17 14:41:06 +0300 | [diff] [blame] | 39 | select X509_CERTIFICATE_PARSER |
| 40 | help |
| 41 | This option enables digital signature verification using |
| 42 | asymmetric keys. |
| 43 | |
| Dmitry Kasatkin | f4dc377 | 2015-10-22 21:26:10 +0300 | [diff] [blame] | 44 | config INTEGRITY_TRUSTED_KEYRING |
| 45 | bool "Require all keys on the integrity keyrings be signed" |
| 46 | depends on SYSTEM_TRUSTED_KEYRING |
| 47 | depends on INTEGRITY_ASYMMETRIC_KEYS |
| Dmitry Kasatkin | f4dc377 | 2015-10-22 21:26:10 +0300 | [diff] [blame] | 48 | default y |
| 49 | help |
| 50 | This option requires that all keys added to the .ima and |
| 51 | .evm keyrings be signed by a key on the system trusted |
| 52 | keyring. |
| 53 | |
| Nayna Jain | 9dc92c4 | 2018-12-09 01:56:59 +0530 | [diff] [blame] | 54 | config INTEGRITY_PLATFORM_KEYRING |
| 55 | bool "Provide keyring for platform/firmware trusted keys" |
| 56 | depends on INTEGRITY_ASYMMETRIC_KEYS |
| 57 | depends on SYSTEM_BLACKLIST_KEYRING |
| Nayna Jain | 9dc92c4 | 2018-12-09 01:56:59 +0530 | [diff] [blame] | 58 | help |
| 59 | Provide a separate, distinct keyring for platform trusted keys, which |
| 60 | the kernel automatically populates during initialization from values |
| 61 | provided by the platform for verifying the kexec'ed kerned image |
| 62 | and, possibly, the initramfs signature. |
| 63 | |
| Martin Schwidefsky | 9641b8c | 2019-02-21 14:23:04 +0100 | [diff] [blame] | 64 | config LOAD_UEFI_KEYS |
| 65 | depends on INTEGRITY_PLATFORM_KEYRING |
| 66 | depends on EFI |
| 67 | def_bool y |
| 68 | |
| 69 | config LOAD_IPL_KEYS |
| 70 | depends on INTEGRITY_PLATFORM_KEYRING |
| 71 | depends on S390 |
| 72 | def_bool y |
| 73 | |
| Mimi Zohar | d726d8d | 2013-03-18 14:48:02 -0400 | [diff] [blame] | 74 | config INTEGRITY_AUDIT |
| 75 | bool "Enables integrity auditing support " |
| Dmitry Kasatkin | 7ef84e6 | 2014-04-17 15:07:15 +0300 | [diff] [blame] | 76 | depends on AUDIT |
| Mimi Zohar | d726d8d | 2013-03-18 14:48:02 -0400 | [diff] [blame] | 77 | default y |
| 78 | help |
| 79 | In addition to enabling integrity auditing support, this |
| 80 | option adds a kernel parameter 'integrity_audit', which |
| 81 | controls the level of integrity auditing messages. |
| 82 | 0 - basic integrity auditing messages (default) |
| 83 | 1 - additional integrity auditing messages |
| 84 | |
| 85 | Additional informational integrity auditing messages would |
| 86 | be enabled by specifying 'integrity_audit=1' on the kernel |
| 87 | command line. |
| 88 | |
| Masahiro Yamada | 8636a1f | 2018-12-11 20:01:04 +0900 | [diff] [blame] | 89 | source "security/integrity/ima/Kconfig" |
| 90 | source "security/integrity/evm/Kconfig" |
| Dmitry Kasatkin | 7ef84e6 | 2014-04-17 15:07:15 +0300 | [diff] [blame] | 91 | |
| 92 | endif # if INTEGRITY |