| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116 |
- # SPDX-License-Identifier: GPL-2.0-only
- #
- # Integrity Policy Enforcement (IPE) configuration
- #
- menuconfig SECURITY_IPE
- bool "Integrity Policy Enforcement (IPE)"
- depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL
- select PKCS7_MESSAGE_PARSER
- select SYSTEM_DATA_VERIFICATION
- select IPE_PROP_DM_VERITY if DM_VERITY
- select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG
- select IPE_PROP_FS_VERITY if FS_VERITY
- select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES
- help
- This option enables the Integrity Policy Enforcement LSM
- allowing users to define a policy to enforce a trust-based access
- control. A key feature of IPE is a customizable policy to allow
- admins to reconfigure trust requirements on the fly.
- If unsure, answer N.
- if SECURITY_IPE
- config IPE_BOOT_POLICY
- string "Integrity policy to apply on system startup"
- help
- This option specifies a filepath to an IPE policy that is compiled
- into the kernel. This policy will be enforced until a policy update
- is deployed via the $securityfs/ipe/policies/$policy_name/active
- interface.
- If unsure, leave blank.
- config IPE_POLICY_SIG_SECONDARY_KEYRING
- bool "IPE policy update verification with secondary keyring"
- default y
- depends on SECONDARY_TRUSTED_KEYRING
- help
- Also allow the secondary trusted keyring to verify IPE policy
- updates.
- If unsure, answer Y.
- config IPE_POLICY_SIG_PLATFORM_KEYRING
- bool "IPE policy update verification with platform keyring"
- default y
- depends on INTEGRITY_PLATFORM_KEYRING
- help
- Also allow the platform keyring to verify IPE policy updates.
- If unsure, answer Y.
- menu "IPE Trust Providers"
- config IPE_PROP_DM_VERITY
- bool "Enable support for dm-verity based on root hash"
- depends on DM_VERITY
- help
- This option enables the 'dmverity_roothash' property within IPE
- policies. The property evaluates to TRUE when a file from a dm-verity
- volume is evaluated, and the volume's root hash matches the value
- supplied in the policy.
- config IPE_PROP_DM_VERITY_SIGNATURE
- bool "Enable support for dm-verity based on root hash signature"
- depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG
- help
- This option enables the 'dmverity_signature' property within IPE
- policies. The property evaluates to TRUE when a file from a dm-verity
- volume, which has been mounted with a valid signed root hash,
- is evaluated.
- If unsure, answer Y.
- config IPE_PROP_FS_VERITY
- bool "Enable support for fs-verity based on file digest"
- depends on FS_VERITY
- help
- This option enables the 'fsverity_digest' property within IPE
- policies. The property evaluates to TRUE when a file is fsverity
- enabled and its digest matches the supplied digest value in the
- policy.
- if unsure, answer Y.
- config IPE_PROP_FS_VERITY_BUILTIN_SIG
- bool "Enable support for fs-verity based on builtin signature"
- depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES
- help
- This option enables the 'fsverity_signature' property within IPE
- policies. The property evaluates to TRUE when a file is fsverity
- enabled and it has a valid builtin signature whose signing cert
- is in the .fs-verity keyring.
- if unsure, answer Y.
- endmenu
- config SECURITY_IPE_KUNIT_TEST
- bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS
- depends on KUNIT=y
- default KUNIT_ALL_TESTS
- help
- This builds the IPE KUnit tests.
- KUnit tests run during boot and output the results to the debug log
- in TAP format (https://testanything.org/). Only useful for kernel devs
- running KUnit test harness and are not for inclusion into a
- production build.
- For more information on KUnit and unit tests in general please refer
- to the KUnit documentation in Documentation/dev-tools/kunit/.
- If unsure, say N.
- endif
|
