1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 2f381c272SMimi Zohar# 3f381c272SMimi Zoharconfig INTEGRITY 47ef84e65SDmitry Kasatkin bool "Integrity subsystem" 57ef84e65SDmitry Kasatkin depends on SECURITY 67ef84e65SDmitry Kasatkin default y 77ef84e65SDmitry Kasatkin help 87ef84e65SDmitry Kasatkin This option enables the integrity subsystem, which is comprised 97ef84e65SDmitry Kasatkin of a number of different components including the Integrity 107ef84e65SDmitry Kasatkin Measurement Architecture (IMA), Extended Verification Module 117ef84e65SDmitry Kasatkin (EVM), IMA-appraisal extension, digital signature verification 127ef84e65SDmitry Kasatkin extension and audit measurement log support. 137ef84e65SDmitry Kasatkin 147ef84e65SDmitry Kasatkin Each of these components can be enabled/disabled separately. 157ef84e65SDmitry Kasatkin Refer to the individual components for additional details. 167ef84e65SDmitry Kasatkin 177ef84e65SDmitry Kasatkinif INTEGRITY 18f381c272SMimi Zohar 19f1be242cSDmitry Kasatkinconfig INTEGRITY_SIGNATURE 206341e62bSChristoph Jaeger bool "Digital signature verification using multiple keyrings" 218607c501SDmitry Kasatkin default n 22cf38fed1SThiago Jung Bauermann select KEYS 235e8898e9SDmitry Kasatkin select SIGNATURE 248607c501SDmitry Kasatkin help 258607c501SDmitry Kasatkin This option enables digital signature verification support 268607c501SDmitry Kasatkin using multiple keyrings. It defines separate keyrings for each 278607c501SDmitry Kasatkin of the different use cases - evm, ima, and modules. 288607c501SDmitry Kasatkin Different keyrings improves search performance, but also allow 298607c501SDmitry Kasatkin to "lock" certain keyring to prevent adding new keys. 308607c501SDmitry Kasatkin This is useful for evm and module keyrings, when keys are 318607c501SDmitry Kasatkin usually only added from initramfs. 328607c501SDmitry Kasatkin 331ae8f41cSDmitry Kasatkinconfig INTEGRITY_ASYMMETRIC_KEYS 346341e62bSChristoph Jaeger bool "Enable asymmetric keys support" 351ae8f41cSDmitry Kasatkin depends on INTEGRITY_SIGNATURE 361ae8f41cSDmitry Kasatkin default n 371ae8f41cSDmitry Kasatkin select ASYMMETRIC_KEY_TYPE 381ae8f41cSDmitry Kasatkin select ASYMMETRIC_PUBLIC_KEY_SUBTYPE 39eb5798f2STadeusz Struk select CRYPTO_RSA 401ae8f41cSDmitry Kasatkin select X509_CERTIFICATE_PARSER 411ae8f41cSDmitry Kasatkin help 421ae8f41cSDmitry Kasatkin This option enables digital signature verification using 431ae8f41cSDmitry Kasatkin asymmetric keys. 441ae8f41cSDmitry Kasatkin 45f4dc3778SDmitry Kasatkinconfig INTEGRITY_TRUSTED_KEYRING 46f4dc3778SDmitry Kasatkin bool "Require all keys on the integrity keyrings be signed" 47f4dc3778SDmitry Kasatkin depends on SYSTEM_TRUSTED_KEYRING 48f4dc3778SDmitry Kasatkin depends on INTEGRITY_ASYMMETRIC_KEYS 49f4dc3778SDmitry Kasatkin default y 50f4dc3778SDmitry Kasatkin help 51f4dc3778SDmitry Kasatkin This option requires that all keys added to the .ima and 52f4dc3778SDmitry Kasatkin .evm keyrings be signed by a key on the system trusted 53f4dc3778SDmitry Kasatkin keyring. 54f4dc3778SDmitry Kasatkin 559dc92c45SNayna Jainconfig INTEGRITY_PLATFORM_KEYRING 569dc92c45SNayna Jain bool "Provide keyring for platform/firmware trusted keys" 579dc92c45SNayna Jain depends on INTEGRITY_ASYMMETRIC_KEYS 589dc92c45SNayna Jain depends on SYSTEM_BLACKLIST_KEYRING 599dc92c45SNayna Jain help 609dc92c45SNayna Jain Provide a separate, distinct keyring for platform trusted keys, which 619dc92c45SNayna Jain the kernel automatically populates during initialization from values 629dc92c45SNayna Jain provided by the platform for verifying the kexec'ed kerned image 639dc92c45SNayna Jain and, possibly, the initramfs signature. 649dc92c45SNayna Jain 659641b8ccSMartin Schwidefskyconfig LOAD_UEFI_KEYS 669641b8ccSMartin Schwidefsky depends on INTEGRITY_PLATFORM_KEYRING 679641b8ccSMartin Schwidefsky depends on EFI 689641b8ccSMartin Schwidefsky def_bool y 699641b8ccSMartin Schwidefsky 709641b8ccSMartin Schwidefskyconfig LOAD_IPL_KEYS 719641b8ccSMartin Schwidefsky depends on INTEGRITY_PLATFORM_KEYRING 729641b8ccSMartin Schwidefsky depends on S390 739641b8ccSMartin Schwidefsky def_bool y 749641b8ccSMartin Schwidefsky 758220e22dSNayna Jainconfig LOAD_PPC_KEYS 768220e22dSNayna Jain bool "Enable loading of platform and blacklisted keys for POWER" 778220e22dSNayna Jain depends on INTEGRITY_PLATFORM_KEYRING 788220e22dSNayna Jain depends on PPC_SECURE_BOOT 798220e22dSNayna Jain default y 808220e22dSNayna Jain help 818220e22dSNayna Jain Enable loading of keys to the .platform keyring and blacklisted 828220e22dSNayna Jain hashes to the .blacklist keyring for powerpc based platforms. 838220e22dSNayna Jain 84d726d8d7SMimi Zoharconfig INTEGRITY_AUDIT 85d726d8d7SMimi Zohar bool "Enables integrity auditing support " 867ef84e65SDmitry Kasatkin depends on AUDIT 87d726d8d7SMimi Zohar default y 88d726d8d7SMimi Zohar help 89d726d8d7SMimi Zohar In addition to enabling integrity auditing support, this 90d726d8d7SMimi Zohar option adds a kernel parameter 'integrity_audit', which 91d726d8d7SMimi Zohar controls the level of integrity auditing messages. 92d726d8d7SMimi Zohar 0 - basic integrity auditing messages (default) 93d726d8d7SMimi Zohar 1 - additional integrity auditing messages 94d726d8d7SMimi Zohar 95d726d8d7SMimi Zohar Additional informational integrity auditing messages would 96d726d8d7SMimi Zohar be enabled by specifying 'integrity_audit=1' on the kernel 97d726d8d7SMimi Zohar command line. 98d726d8d7SMimi Zohar 998636a1f9SMasahiro Yamadasource "security/integrity/ima/Kconfig" 1008636a1f9SMasahiro Yamadasource "security/integrity/evm/Kconfig" 1017ef84e65SDmitry Kasatkin 1027ef84e65SDmitry Kasatkinendif # if INTEGRITY 103