| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | # |
| 3 | # Integrity Policy Enforcement (IPE) configuration |
| 4 | # |
| 5 | |
| 6 | menuconfig SECURITY_IPE |
| 7 | bool "Integrity Policy Enforcement (IPE)" |
| 8 | depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL |
| 9 | select CRYPTO_LIB_SHA256 |
| 10 | select PKCS7_MESSAGE_PARSER |
| 11 | select SYSTEM_DATA_VERIFICATION |
| 12 | select IPE_PROP_DM_VERITY if DM_VERITY |
| 13 | select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG |
| 14 | select IPE_PROP_FS_VERITY if FS_VERITY |
| 15 | select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES |
| 16 | help |
| 17 | This option enables the Integrity Policy Enforcement LSM |
| 18 | allowing users to define a policy to enforce a trust-based access |
| 19 | control. A key feature of IPE is a customizable policy to allow |
| 20 | admins to reconfigure trust requirements on the fly. |
| 21 | |
| 22 | If unsure, answer N. |
| 23 | |
| 24 | if SECURITY_IPE |
| 25 | config IPE_BOOT_POLICY |
| 26 | string "Integrity policy to apply on system startup" |
| 27 | help |
| 28 | This option specifies a filepath to an IPE policy that is compiled |
| 29 | into the kernel. This policy will be enforced until a policy update |
| 30 | is deployed via the $securityfs/ipe/policies/$policy_name/active |
| 31 | interface. |
| 32 | |
| 33 | If unsure, leave blank. |
| 34 | |
| 35 | config IPE_POLICY_SIG_SECONDARY_KEYRING |
| 36 | bool "IPE policy update verification with secondary keyring" |
| 37 | default y |
| 38 | depends on SECONDARY_TRUSTED_KEYRING |
| 39 | help |
| 40 | Also allow the secondary trusted keyring to verify IPE policy |
| 41 | updates. |
| 42 | |
| 43 | If unsure, answer Y. |
| 44 | |
| 45 | config IPE_POLICY_SIG_PLATFORM_KEYRING |
| 46 | bool "IPE policy update verification with platform keyring" |
| 47 | default y |
| 48 | depends on INTEGRITY_PLATFORM_KEYRING |
| 49 | help |
| 50 | Also allow the platform keyring to verify IPE policy updates. |
| 51 | |
| 52 | If unsure, answer Y. |
| 53 | |
| 54 | menu "IPE Trust Providers" |
| 55 | |
| 56 | config IPE_PROP_DM_VERITY |
| 57 | bool "Enable support for dm-verity based on root hash" |
| 58 | depends on DM_VERITY |
| 59 | help |
| 60 | This option enables the 'dmverity_roothash' property within IPE |
| 61 | policies. The property evaluates to TRUE when a file from a dm-verity |
| 62 | volume is evaluated, and the volume's root hash matches the value |
| 63 | supplied in the policy. |
| 64 | |
| 65 | config IPE_PROP_DM_VERITY_SIGNATURE |
| 66 | bool "Enable support for dm-verity based on root hash signature" |
| 67 | depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG |
| 68 | help |
| 69 | This option enables the 'dmverity_signature' property within IPE |
| 70 | policies. The property evaluates to TRUE when a file from a dm-verity |
| 71 | volume, which has been mounted with a valid signed root hash, |
| 72 | is evaluated. |
| 73 | |
| 74 | If unsure, answer Y. |
| 75 | |
| 76 | config IPE_PROP_FS_VERITY |
| 77 | bool "Enable support for fs-verity based on file digest" |
| 78 | depends on FS_VERITY |
| 79 | help |
| 80 | This option enables the 'fsverity_digest' property within IPE |
| 81 | policies. The property evaluates to TRUE when a file is fsverity |
| 82 | enabled and its digest matches the supplied digest value in the |
| 83 | policy. |
| 84 | |
| 85 | if unsure, answer Y. |
| 86 | |
| 87 | config IPE_PROP_FS_VERITY_BUILTIN_SIG |
| 88 | bool "Enable support for fs-verity based on builtin signature" |
| 89 | depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES |
| 90 | help |
| 91 | This option enables the 'fsverity_signature' property within IPE |
| 92 | policies. The property evaluates to TRUE when a file is fsverity |
| 93 | enabled and it has a valid builtin signature whose signing cert |
| 94 | is in the .fs-verity keyring. |
| 95 | |
| 96 | if unsure, answer Y. |
| 97 | |
| 98 | endmenu |
| 99 | |
| 100 | config SECURITY_IPE_KUNIT_TEST |
| 101 | bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS |
| 102 | depends on KUNIT=y |
| 103 | default KUNIT_ALL_TESTS |
| 104 | help |
| 105 | This builds the IPE KUnit tests. |
| 106 | |
| 107 | KUnit tests run during boot and output the results to the debug log |
| 108 | in TAP format (https://testanything.org/). Only useful for kernel devs |
| 109 | running KUnit test harness and are not for inclusion into a |
| 110 | production build. |
| 111 | |
| 112 | For more information on KUnit and unit tests in general please refer |
| 113 | to the KUnit documentation in Documentation/dev-tools/kunit/. |
| 114 | |
| 115 | If unsure, say N. |
| 116 | |
| 117 | endif |