blob: e54a8a8dae941f1e2bbff37962184f4f1c84c192 [file] [log] [blame]
Mimi Zohar3323eec2009-02-04 09:06:58 -05001# IBM Integrity Measurement Architecture
2#
3config IMA
4 bool "Integrity Measurement Architecture(IMA)"
Mimi Zohar3323eec2009-02-04 09:06:58 -05005 select SECURITYFS
6 select CRYPTO
7 select CRYPTO_HMAC
8 select CRYPTO_MD5
9 select CRYPTO_SHA1
Dmitry Kasatkinc7c8bb22013-04-25 10:43:56 +030010 select CRYPTO_HASH_INFO
Fabio Estevamf4a03912012-01-05 12:49:54 -020011 select TCG_TPM if HAS_IOMEM && !UML
Randy Dunlapa69f1582012-02-24 11:28:05 -080012 select TCG_TIS if TCG_TPM && X86
Michael Ellerman63a0eb72014-12-03 17:04:50 +110013 select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
Mimi Zohar3323eec2009-02-04 09:06:58 -050014 help
15 The Trusted Computing Group(TCG) runtime Integrity
16 Measurement Architecture(IMA) maintains a list of hash
17 values of executables and other sensitive system files,
18 as they are read or executed. If an attacker manages
19 to change the contents of an important system file
20 being measured, we can tell.
21
22 If your system has a TPM chip, then IMA also maintains
23 an aggregate integrity value over this list inside the
24 TPM hardware, so that the TPM can prove to a third party
25 whether or not critical system files have been modified.
26 Read <http://www.usenix.org/events/sec04/tech/sailer.html>
27 to learn more about IMA.
28 If unsure, say N.
29
30config IMA_MEASURE_PCR_IDX
31 int
32 depends on IMA
33 range 8 14
34 default 10
35 help
36 IMA_MEASURE_PCR_IDX determines the TPM PCR register index
37 that IMA uses to maintain the integrity aggregate of the
38 measurement list. If unsure, use the default 10.
39
Mimi Zohar4af46622009-02-04 09:07:00 -050040config IMA_LSM_RULES
41 bool
Randy Dunlapb53fab92009-02-12 09:54:14 -080042 depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)
Mimi Zohar4af46622009-02-04 09:07:00 -050043 default y
44 help
Randy Dunlapb53fab92009-02-12 09:54:14 -080045 Disabling this option will disregard LSM based policy rules.
Mimi Zohar2fe5d6d2012-02-13 10:15:05 -050046
Mimi Zohar42865872013-06-07 12:16:34 +020047choice
48 prompt "Default template"
49 default IMA_NG_TEMPLATE
50 depends on IMA
51 help
52 Select the default IMA measurement template.
53
54 The original 'ima' measurement list template contains a
55 hash, defined as 20 bytes, and a null terminated pathname,
56 limited to 255 characters. The 'ima-ng' measurement list
57 template permits both larger hash digests and longer
58 pathnames.
59
60 config IMA_TEMPLATE
61 bool "ima"
62 config IMA_NG_TEMPLATE
63 bool "ima-ng (default)"
Mimi Zoharbcbc9b02013-07-23 11:15:00 -040064 config IMA_SIG_TEMPLATE
65 bool "ima-sig"
Mimi Zohar42865872013-06-07 12:16:34 +020066endchoice
67
68config IMA_DEFAULT_TEMPLATE
69 string
70 depends on IMA
71 default "ima" if IMA_TEMPLATE
72 default "ima-ng" if IMA_NG_TEMPLATE
Mimi Zoharbcbc9b02013-07-23 11:15:00 -040073 default "ima-sig" if IMA_SIG_TEMPLATE
Mimi Zohar42865872013-06-07 12:16:34 +020074
Mimi Zohare7a2ad72013-06-07 12:16:37 +020075choice
76 prompt "Default integrity hash algorithm"
77 default IMA_DEFAULT_HASH_SHA1
78 depends on IMA
79 help
80 Select the default hash algorithm used for the measurement
81 list, integrity appraisal and audit log. The compiled default
82 hash algorithm can be overwritten using the kernel command
83 line 'ima_hash=' option.
84
85 config IMA_DEFAULT_HASH_SHA1
86 bool "SHA1 (default)"
87 depends on CRYPTO_SHA1
88
89 config IMA_DEFAULT_HASH_SHA256
90 bool "SHA256"
91 depends on CRYPTO_SHA256 && !IMA_TEMPLATE
92
93 config IMA_DEFAULT_HASH_SHA512
94 bool "SHA512"
95 depends on CRYPTO_SHA512 && !IMA_TEMPLATE
96
97 config IMA_DEFAULT_HASH_WP512
98 bool "WP512"
99 depends on CRYPTO_WP512 && !IMA_TEMPLATE
100endchoice
101
102config IMA_DEFAULT_HASH
103 string
104 depends on IMA
105 default "sha1" if IMA_DEFAULT_HASH_SHA1
106 default "sha256" if IMA_DEFAULT_HASH_SHA256
107 default "sha512" if IMA_DEFAULT_HASH_SHA512
108 default "wp512" if IMA_DEFAULT_HASH_WP512
109
Petko Manolov38d859f2015-12-02 17:47:54 +0200110config IMA_WRITE_POLICY
111 bool "Enable multiple writes to the IMA policy"
112 depends on IMA
113 default n
114 help
115 IMA policy can now be updated multiple times. The new rules get
116 appended to the original policy. Have in mind that the rules are
117 scanned in FIFO order so be careful when you design and add new ones.
118
119 If unsure, say N.
120
Petko Manolov80eae202015-12-02 17:47:56 +0200121config IMA_READ_POLICY
122 bool "Enable reading back the current IMA policy"
123 depends on IMA
124 default y if IMA_WRITE_POLICY
125 default n if !IMA_WRITE_POLICY
126 help
127 It is often useful to be able to read back the IMA policy. It is
128 even more important after introducing CONFIG_IMA_WRITE_POLICY.
129 This option allows the root user to see the current policy rules.
130
Mimi Zohar2fe5d6d2012-02-13 10:15:05 -0500131config IMA_APPRAISE
132 bool "Appraise integrity measurements"
133 depends on IMA
134 default n
135 help
136 This option enables local measurement integrity appraisal.
137 It requires the system to be labeled with a security extended
138 attribute containing the file hash measurement. To protect
139 the security extended attributes from offline attack, enable
140 and configure EVM.
141
142 For more information on integrity appraisal refer to:
143 <http://linux-ima.sourceforge.net>
144 If unsure, say N.
Mimi Zohar7d2ce232013-08-13 08:47:43 -0400145
146config IMA_TRUSTED_KEYRING
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +0300147 bool "Require all keys on the .ima keyring be signed (deprecated)"
Mimi Zohar7d2ce232013-08-13 08:47:43 -0400148 depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
149 depends on INTEGRITY_ASYMMETRIC_KEYS
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +0300150 select INTEGRITY_TRUSTED_KEYRING
Mimi Zohar7d2ce232013-08-13 08:47:43 -0400151 default y
152 help
153 This option requires that all keys added to the .ima
154 keyring be signed by a key on the system trusted keyring.
Dmitry Kasatkinfd5f4e902014-11-05 17:01:14 +0200155
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +0300156 This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING
157
Petko Manolov41c89b62015-12-02 17:47:55 +0200158config IMA_MOK_KEYRING
159 bool "Create IMA machine owner keys (MOK) and blacklist keyrings"
160 depends on SYSTEM_TRUSTED_KEYRING
161 depends on IMA_TRUSTED_KEYRING
162 default n
163 help
164 This option creates IMA MOK and blacklist keyrings. IMA MOK is an
165 intermediate keyring that sits between .system and .ima keyrings,
166 effectively forming a simple CA hierarchy. To successfully import a
167 key into .ima_mok it must be signed by a key which CA is in .system
168 keyring. On turn any key that needs to go in .ima keyring must be
169 signed by CA in either .system or .ima_mok keyrings. IMA MOK is empty
170 at kernel boot.
171
172 IMA blacklist keyring contains all revoked IMA keys. It is consulted
173 before any other keyring. If the search is successful the requested
174 operation is rejected and error is returned to the caller.
175
Dmitry Kasatkinfd5f4e902014-11-05 17:01:14 +0200176config IMA_LOAD_X509
177 bool "Load X509 certificate onto the '.ima' trusted keyring"
178 depends on IMA_TRUSTED_KEYRING
179 default n
180 help
181 File signature verification is based on the public keys
182 loaded on the .ima trusted keyring. These public keys are
183 X509 certificates signed by a trusted key on the
184 .system keyring. This option enables X509 certificate
185 loading from the kernel onto the '.ima' trusted keyring.
186
187config IMA_X509_PATH
188 string "IMA X509 certificate path"
189 depends on IMA_LOAD_X509
190 default "/etc/keys/x509_ima.der"
191 help
192 This option defines IMA X509 certificate path.
Dmitry Kasatkinc57782c2014-11-05 17:01:16 +0200193
194config IMA_APPRAISE_SIGNED_INIT
195 bool "Require signed user-space initialization"
196 depends on IMA_LOAD_X509
197 default n
198 help
199 This option requires user-space init to be signed.