1*4882a593Smuzhiyun# SPDX-License-Identifier: GPL-2.0-only 2*4882a593Smuzhiyun# 3*4882a593Smuzhiyunconfig INTEGRITY 4*4882a593Smuzhiyun bool "Integrity subsystem" 5*4882a593Smuzhiyun depends on SECURITY 6*4882a593Smuzhiyun default y 7*4882a593Smuzhiyun help 8*4882a593Smuzhiyun This option enables the integrity subsystem, which is comprised 9*4882a593Smuzhiyun of a number of different components including the Integrity 10*4882a593Smuzhiyun Measurement Architecture (IMA), Extended Verification Module 11*4882a593Smuzhiyun (EVM), IMA-appraisal extension, digital signature verification 12*4882a593Smuzhiyun extension and audit measurement log support. 13*4882a593Smuzhiyun 14*4882a593Smuzhiyun Each of these components can be enabled/disabled separately. 15*4882a593Smuzhiyun Refer to the individual components for additional details. 16*4882a593Smuzhiyun 17*4882a593Smuzhiyunif INTEGRITY 18*4882a593Smuzhiyun 19*4882a593Smuzhiyunconfig INTEGRITY_SIGNATURE 20*4882a593Smuzhiyun bool "Digital signature verification using multiple keyrings" 21*4882a593Smuzhiyun default n 22*4882a593Smuzhiyun select KEYS 23*4882a593Smuzhiyun select SIGNATURE 24*4882a593Smuzhiyun help 25*4882a593Smuzhiyun This option enables digital signature verification support 26*4882a593Smuzhiyun using multiple keyrings. It defines separate keyrings for each 27*4882a593Smuzhiyun of the different use cases - evm, ima, and modules. 28*4882a593Smuzhiyun Different keyrings improves search performance, but also allow 29*4882a593Smuzhiyun to "lock" certain keyring to prevent adding new keys. 30*4882a593Smuzhiyun This is useful for evm and module keyrings, when keys are 31*4882a593Smuzhiyun usually only added from initramfs. 32*4882a593Smuzhiyun 33*4882a593Smuzhiyunconfig INTEGRITY_ASYMMETRIC_KEYS 34*4882a593Smuzhiyun bool "Enable asymmetric keys support" 35*4882a593Smuzhiyun depends on INTEGRITY_SIGNATURE 36*4882a593Smuzhiyun default n 37*4882a593Smuzhiyun select ASYMMETRIC_KEY_TYPE 38*4882a593Smuzhiyun select ASYMMETRIC_PUBLIC_KEY_SUBTYPE 39*4882a593Smuzhiyun select CRYPTO_RSA 40*4882a593Smuzhiyun select X509_CERTIFICATE_PARSER 41*4882a593Smuzhiyun help 42*4882a593Smuzhiyun This option enables digital signature verification using 43*4882a593Smuzhiyun asymmetric keys. 44*4882a593Smuzhiyun 45*4882a593Smuzhiyunconfig INTEGRITY_TRUSTED_KEYRING 46*4882a593Smuzhiyun bool "Require all keys on the integrity keyrings be signed" 47*4882a593Smuzhiyun depends on SYSTEM_TRUSTED_KEYRING 48*4882a593Smuzhiyun depends on INTEGRITY_ASYMMETRIC_KEYS 49*4882a593Smuzhiyun default y 50*4882a593Smuzhiyun help 51*4882a593Smuzhiyun This option requires that all keys added to the .ima and 52*4882a593Smuzhiyun .evm keyrings be signed by a key on the system trusted 53*4882a593Smuzhiyun keyring. 54*4882a593Smuzhiyun 55*4882a593Smuzhiyunconfig INTEGRITY_PLATFORM_KEYRING 56*4882a593Smuzhiyun bool "Provide keyring for platform/firmware trusted keys" 57*4882a593Smuzhiyun depends on INTEGRITY_ASYMMETRIC_KEYS 58*4882a593Smuzhiyun depends on SYSTEM_BLACKLIST_KEYRING 59*4882a593Smuzhiyun help 60*4882a593Smuzhiyun Provide a separate, distinct keyring for platform trusted keys, which 61*4882a593Smuzhiyun the kernel automatically populates during initialization from values 62*4882a593Smuzhiyun provided by the platform for verifying the kexec'ed kerned image 63*4882a593Smuzhiyun and, possibly, the initramfs signature. 64*4882a593Smuzhiyun 65*4882a593Smuzhiyunconfig LOAD_UEFI_KEYS 66*4882a593Smuzhiyun depends on INTEGRITY_PLATFORM_KEYRING 67*4882a593Smuzhiyun depends on EFI 68*4882a593Smuzhiyun def_bool y 69*4882a593Smuzhiyun 70*4882a593Smuzhiyunconfig LOAD_IPL_KEYS 71*4882a593Smuzhiyun depends on INTEGRITY_PLATFORM_KEYRING 72*4882a593Smuzhiyun depends on S390 73*4882a593Smuzhiyun def_bool y 74*4882a593Smuzhiyun 75*4882a593Smuzhiyunconfig LOAD_PPC_KEYS 76*4882a593Smuzhiyun bool "Enable loading of platform and blacklisted keys for POWER" 77*4882a593Smuzhiyun depends on INTEGRITY_PLATFORM_KEYRING 78*4882a593Smuzhiyun depends on PPC_SECURE_BOOT 79*4882a593Smuzhiyun default y 80*4882a593Smuzhiyun help 81*4882a593Smuzhiyun Enable loading of keys to the .platform keyring and blacklisted 82*4882a593Smuzhiyun hashes to the .blacklist keyring for powerpc based platforms. 83*4882a593Smuzhiyun 84*4882a593Smuzhiyunconfig INTEGRITY_AUDIT 85*4882a593Smuzhiyun bool "Enables integrity auditing support " 86*4882a593Smuzhiyun depends on AUDIT 87*4882a593Smuzhiyun default y 88*4882a593Smuzhiyun help 89*4882a593Smuzhiyun In addition to enabling integrity auditing support, this 90*4882a593Smuzhiyun option adds a kernel parameter 'integrity_audit', which 91*4882a593Smuzhiyun controls the level of integrity auditing messages. 92*4882a593Smuzhiyun 0 - basic integrity auditing messages (default) 93*4882a593Smuzhiyun 1 - additional integrity auditing messages 94*4882a593Smuzhiyun 95*4882a593Smuzhiyun Additional informational integrity auditing messages would 96*4882a593Smuzhiyun be enabled by specifying 'integrity_audit=1' on the kernel 97*4882a593Smuzhiyun command line. 98*4882a593Smuzhiyun 99*4882a593Smuzhiyunsource "security/integrity/ima/Kconfig" 100*4882a593Smuzhiyunsource "security/integrity/evm/Kconfig" 101*4882a593Smuzhiyun 102*4882a593Smuzhiyunendif # if INTEGRITY 103