| David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 1 | # |
| 2 | # Key management configuration |
| 3 | # |
| 4 | |
| 5 | config KEYS |
| 6 | bool "Enable access key retention support" |
| 7 | help |
| 8 | This option provides support for retaining authentication tokens and |
| 9 | access keys in the kernel. |
| 10 | |
| 11 | It also includes provision of methods by which such keys might be |
| 12 | associated with a process so that network filesystems, encryption |
| 13 | support and the like can find them. |
| 14 | |
| 15 | Furthermore, a special type of key is available that acts as keyring: |
| 16 | a searchable sequence of keys. Each process is equipped with access |
| 17 | to five standard keyrings: UID-specific, GID-specific, session, |
| 18 | process and thread. |
| 19 | |
| 20 | If you are unsure as to whether this is required, answer N. |
| 21 | |
| 22 | config TRUSTED_KEYS |
| 23 | tristate "TRUSTED KEYS" |
| 24 | depends on KEYS && TCG_TPM |
| 25 | select CRYPTO |
| 26 | select CRYPTO_HMAC |
| 27 | select CRYPTO_SHA1 |
| 28 | help |
| 29 | This option provides support for creating, sealing, and unsealing |
| 30 | keys in the kernel. Trusted keys are random number symmetric keys, |
| 31 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, |
| 32 | if the boot PCRs and other criteria match. Userspace will only ever |
| 33 | see encrypted blobs. |
| 34 | |
| 35 | If you are unsure as to whether this is required, answer N. |
| 36 | |
| 37 | config ENCRYPTED_KEYS |
| 38 | tristate "ENCRYPTED KEYS" |
| 39 | depends on KEYS |
| 40 | select CRYPTO |
| 41 | select CRYPTO_HMAC |
| 42 | select CRYPTO_AES |
| 43 | select CRYPTO_CBC |
| 44 | select CRYPTO_SHA256 |
| 45 | select CRYPTO_RNG |
| 46 | help |
| 47 | This option provides support for create/encrypting/decrypting keys |
| 48 | in the kernel. Encrypted keys are kernel generated random numbers, |
| 49 | which are encrypted/decrypted with a 'master' symmetric key. The |
| 50 | 'master' key can be either a trusted-key or user-key type. |
| 51 | Userspace only ever sees/stores encrypted blobs. |
| 52 | |
| 53 | If you are unsure as to whether this is required, answer N. |
| 54 | |
| 55 | config KEYS_DEBUG_PROC_KEYS |
| 56 | bool "Enable the /proc/keys file by which keys may be viewed" |
| 57 | depends on KEYS |
| 58 | help |
| 59 | This option turns on support for the /proc/keys file - through which |
| 60 | can be listed all the keys on the system that are viewable by the |
| 61 | reading process. |
| 62 | |
| 63 | The only keys included in the list are those that grant View |
| 64 | permission to the reading process whether or not it possesses them. |
| 65 | Note that LSM security checks are still performed, and may further |
| 66 | filter out keys that the current process is not authorised to view. |
| 67 | |
| 68 | Only key attributes are listed here; key payloads are not included in |
| 69 | the resulting table. |
| 70 | |
| 71 | If you are unsure as to whether this is required, answer N. |