| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | # |
| 3 | config INTEGRITY |
| 4 | bool "Integrity subsystem" |
| 5 | depends on SECURITY |
| 6 | default y |
| 7 | help |
| 8 | This option enables the integrity subsystem, which is comprised |
| 9 | of a number of different components including the Integrity |
| 10 | Measurement Architecture (IMA), Extended Verification Module |
| 11 | (EVM), IMA-appraisal extension, digital signature verification |
| 12 | extension and audit measurement log support. |
| 13 | |
| 14 | Each of these components can be enabled/disabled separately. |
| 15 | Refer to the individual components for additional details. |
| 16 | |
| 17 | if INTEGRITY |
| 18 | |
| 19 | config INTEGRITY_SIGNATURE |
| 20 | bool "Digital signature verification using multiple keyrings" |
| 21 | default n |
| 22 | select KEYS |
| 23 | select SIGNATURE |
| 24 | help |
| 25 | This option enables digital signature verification support |
| 26 | using multiple keyrings. It defines separate keyrings for each |
| 27 | of the different use cases - evm, ima, and modules. |
| 28 | Different keyrings improves search performance, but also allow |
| 29 | to "lock" certain keyring to prevent adding new keys. |
| 30 | This is useful for evm and module keyrings, when keys are |
| 31 | usually only added from initramfs. |
| 32 | |
| 33 | config INTEGRITY_ASYMMETRIC_KEYS |
| 34 | bool "Enable asymmetric keys support" |
| 35 | depends on INTEGRITY_SIGNATURE |
| 36 | default n |
| 37 | select ASYMMETRIC_KEY_TYPE |
| 38 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE |
| 39 | select CRYPTO |
| 40 | select CRYPTO_RSA |
| 41 | select X509_CERTIFICATE_PARSER |
| 42 | help |
| 43 | This option enables digital signature verification using |
| 44 | asymmetric keys. |
| 45 | |
| 46 | config INTEGRITY_TRUSTED_KEYRING |
| 47 | bool "Require all keys on the integrity keyrings be signed" |
| 48 | depends on SYSTEM_TRUSTED_KEYRING |
| 49 | depends on INTEGRITY_ASYMMETRIC_KEYS |
| 50 | default y |
| 51 | help |
| 52 | This option requires that all keys added to the .ima and |
| 53 | .evm keyrings be signed by a key on the system trusted |
| 54 | keyring. |
| 55 | |
| 56 | config INTEGRITY_PLATFORM_KEYRING |
| 57 | bool "Provide keyring for platform/firmware trusted keys" |
| 58 | depends on INTEGRITY_ASYMMETRIC_KEYS |
| 59 | depends on SYSTEM_BLACKLIST_KEYRING |
| 60 | help |
| 61 | Provide a separate, distinct keyring for platform trusted keys, which |
| 62 | the kernel automatically populates during initialization from values |
| 63 | provided by the platform for verifying the kexec'ed kerned image |
| 64 | and, possibly, the initramfs signature. |
| 65 | |
| 66 | config INTEGRITY_MACHINE_KEYRING |
| 67 | bool "Provide a keyring to which Machine Owner Keys may be added" |
| 68 | depends on SECONDARY_TRUSTED_KEYRING |
| 69 | depends on INTEGRITY_ASYMMETRIC_KEYS |
| 70 | depends on SYSTEM_BLACKLIST_KEYRING |
| 71 | depends on LOAD_UEFI_KEYS || LOAD_PPC_KEYS |
| 72 | help |
| 73 | If set, provide a keyring to which Machine Owner Keys (MOK) may |
| 74 | be added. This keyring shall contain just MOK keys. Unlike keys |
| 75 | in the platform keyring, keys contained in the .machine keyring will |
| 76 | be trusted within the kernel. |
| 77 | |
| 78 | config INTEGRITY_CA_MACHINE_KEYRING |
| 79 | bool "Enforce Machine Keyring CA Restrictions" |
| 80 | depends on INTEGRITY_MACHINE_KEYRING |
| 81 | default n |
| 82 | help |
| 83 | The .machine keyring can be configured to enforce CA restriction |
| 84 | on any key added to it. By default no restrictions are in place |
| 85 | and all Machine Owner Keys (MOK) are added to the machine keyring. |
| 86 | If enabled only CA keys are added to the machine keyring, all |
| 87 | other MOK keys load into the platform keyring. |
| 88 | |
| 89 | config INTEGRITY_CA_MACHINE_KEYRING_MAX |
| 90 | bool "Only CA keys without DigitialSignature usage set" |
| 91 | depends on INTEGRITY_CA_MACHINE_KEYRING |
| 92 | default n |
| 93 | help |
| 94 | When selected, only load CA keys are loaded into the machine |
| 95 | keyring that contain the CA bit set along with the keyCertSign |
| 96 | Usage field. Keys containing the digitialSignature Usage field |
| 97 | will not be loaded. The remaining MOK keys are loaded into the |
| 98 | .platform keyring. |
| 99 | |
| 100 | config LOAD_UEFI_KEYS |
| 101 | depends on INTEGRITY_PLATFORM_KEYRING |
| 102 | depends on EFI |
| 103 | def_bool y |
| 104 | |
| 105 | config LOAD_IPL_KEYS |
| 106 | depends on INTEGRITY_PLATFORM_KEYRING |
| 107 | depends on S390 |
| 108 | def_bool y |
| 109 | |
| 110 | config LOAD_PPC_KEYS |
| 111 | bool "Enable loading of platform and blacklisted keys for POWER" |
| 112 | depends on INTEGRITY_PLATFORM_KEYRING |
| 113 | depends on PPC_SECURE_BOOT |
| 114 | default y |
| 115 | help |
| 116 | Enable loading of keys to the .platform keyring and blacklisted |
| 117 | hashes to the .blacklist keyring for powerpc based platforms. |
| 118 | |
| 119 | config INTEGRITY_AUDIT |
| 120 | bool "Enables integrity auditing support " |
| 121 | depends on AUDIT |
| 122 | default y |
| 123 | help |
| 124 | In addition to enabling integrity auditing support, this |
| 125 | option adds a kernel parameter 'integrity_audit', which |
| 126 | controls the level of integrity auditing messages. |
| 127 | 0 - basic integrity auditing messages (default) |
| 128 | 1 - additional integrity auditing messages |
| 129 | |
| 130 | Additional informational integrity auditing messages would |
| 131 | be enabled by specifying 'integrity_audit=1' on the kernel |
| 132 | command line. |
| 133 | |
| 134 | source "security/integrity/ima/Kconfig" |
| 135 | source "security/integrity/evm/Kconfig" |
| 136 | |
| 137 | endif # if INTEGRITY |