1f0894940SDavid Howells# 2f0894940SDavid Howells# Key management configuration 3f0894940SDavid Howells# 4f0894940SDavid Howells 5f0894940SDavid Howellsconfig KEYS 6f0894940SDavid Howells bool "Enable access key retention support" 7f0894940SDavid Howells help 8f0894940SDavid Howells This option provides support for retaining authentication tokens and 9f0894940SDavid Howells access keys in the kernel. 10f0894940SDavid Howells 11f0894940SDavid Howells It also includes provision of methods by which such keys might be 12f0894940SDavid Howells associated with a process so that network filesystems, encryption 13f0894940SDavid Howells support and the like can find them. 14f0894940SDavid Howells 15f0894940SDavid Howells Furthermore, a special type of key is available that acts as keyring: 16f0894940SDavid Howells a searchable sequence of keys. Each process is equipped with access 17f0894940SDavid Howells to five standard keyrings: UID-specific, GID-specific, session, 18f0894940SDavid Howells process and thread. 19f0894940SDavid Howells 20f0894940SDavid Howells If you are unsure as to whether this is required, answer N. 21f0894940SDavid Howells 22f0894940SDavid Howellsconfig TRUSTED_KEYS 23f0894940SDavid Howells tristate "TRUSTED KEYS" 24f0894940SDavid Howells depends on KEYS && TCG_TPM 25f0894940SDavid Howells select CRYPTO 26f0894940SDavid Howells select CRYPTO_HMAC 27f0894940SDavid Howells select CRYPTO_SHA1 28f0894940SDavid Howells help 29f0894940SDavid Howells This option provides support for creating, sealing, and unsealing 30f0894940SDavid Howells keys in the kernel. Trusted keys are random number symmetric keys, 31f0894940SDavid Howells generated and RSA-sealed by the TPM. The TPM only unseals the keys, 32f0894940SDavid Howells if the boot PCRs and other criteria match. Userspace will only ever 33f0894940SDavid Howells see encrypted blobs. 34f0894940SDavid Howells 35f0894940SDavid Howells If you are unsure as to whether this is required, answer N. 36f0894940SDavid Howells 37f0894940SDavid Howellsconfig ENCRYPTED_KEYS 38f0894940SDavid Howells tristate "ENCRYPTED KEYS" 39f0894940SDavid Howells depends on KEYS 40f0894940SDavid Howells select CRYPTO 41f0894940SDavid Howells select CRYPTO_HMAC 42f0894940SDavid Howells select CRYPTO_AES 43f0894940SDavid Howells select CRYPTO_CBC 44f0894940SDavid Howells select CRYPTO_SHA256 45f0894940SDavid Howells select CRYPTO_RNG 46f0894940SDavid Howells help 47f0894940SDavid Howells This option provides support for create/encrypting/decrypting keys 48f0894940SDavid Howells in the kernel. Encrypted keys are kernel generated random numbers, 49f0894940SDavid Howells which are encrypted/decrypted with a 'master' symmetric key. The 50f0894940SDavid Howells 'master' key can be either a trusted-key or user-key type. 51f0894940SDavid Howells Userspace only ever sees/stores encrypted blobs. 52f0894940SDavid Howells 53f0894940SDavid Howells If you are unsure as to whether this is required, answer N. 54f0894940SDavid Howells 55f0894940SDavid Howellsconfig KEYS_DEBUG_PROC_KEYS 56f0894940SDavid Howells bool "Enable the /proc/keys file by which keys may be viewed" 57f0894940SDavid Howells depends on KEYS 58f0894940SDavid Howells help 59f0894940SDavid Howells This option turns on support for the /proc/keys file - through which 60f0894940SDavid Howells can be listed all the keys on the system that are viewable by the 61f0894940SDavid Howells reading process. 62f0894940SDavid Howells 63f0894940SDavid Howells The only keys included in the list are those that grant View 64f0894940SDavid Howells permission to the reading process whether or not it possesses them. 65f0894940SDavid Howells Note that LSM security checks are still performed, and may further 66f0894940SDavid Howells filter out keys that the current process is not authorised to view. 67f0894940SDavid Howells 68f0894940SDavid Howells Only key attributes are listed here; key payloads are not included in 69f0894940SDavid Howells the resulting table. 70f0894940SDavid Howells 71f0894940SDavid Howells If you are unsure as to whether this is required, answer N. 72