| Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 1 | # |
| 2 | config INTEGRITY |
| 3 | def_bool y |
| Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 4 | depends on IMA || EVM |
| Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 5 | |
| Dmitry Kasatkin | f1be242 | 2012-01-17 17:12:07 +0200 | [diff] [blame] | 6 | config INTEGRITY_SIGNATURE |
| Dmitry Kasatkin | 8607c50 | 2011-10-05 11:54:46 +0300 | [diff] [blame] | 7 | boolean "Digital signature verification using multiple keyrings" |
| Dmitry Kasatkin | de35353 | 2011-11-21 17:31:15 +0200 | [diff] [blame] | 8 | depends on INTEGRITY && KEYS |
| Dmitry Kasatkin | 8607c50 | 2011-10-05 11:54:46 +0300 | [diff] [blame] | 9 | default n |
| Dmitry Kasatkin | 5e8898e | 2012-01-17 17:12:03 +0200 | [diff] [blame] | 10 | select SIGNATURE |
| Dmitry Kasatkin | 8607c50 | 2011-10-05 11:54:46 +0300 | [diff] [blame] | 11 | help |
| 12 | This option enables digital signature verification support |
| 13 | using multiple keyrings. It defines separate keyrings for each |
| 14 | of the different use cases - evm, ima, and modules. |
| 15 | Different keyrings improves search performance, but also allow |
| 16 | to "lock" certain keyring to prevent adding new keys. |
| 17 | This is useful for evm and module keyrings, when keys are |
| 18 | usually only added from initramfs. |
| 19 | |
| Mimi Zohar | d726d8d | 2013-03-18 14:48:02 -0400 | [diff] [blame] | 20 | config INTEGRITY_AUDIT |
| 21 | bool "Enables integrity auditing support " |
| 22 | depends on INTEGRITY && AUDIT |
| 23 | default y |
| 24 | help |
| 25 | In addition to enabling integrity auditing support, this |
| 26 | option adds a kernel parameter 'integrity_audit', which |
| 27 | controls the level of integrity auditing messages. |
| 28 | 0 - basic integrity auditing messages (default) |
| 29 | 1 - additional integrity auditing messages |
| 30 | |
| 31 | Additional informational integrity auditing messages would |
| 32 | be enabled by specifying 'integrity_audit=1' on the kernel |
| 33 | command line. |
| 34 | |
| Dmitry Kasatkin | e075125 | 2013-02-07 00:12:08 +0200 | [diff] [blame] | 35 | config INTEGRITY_ASYMMETRIC_KEYS |
| 36 | boolean "Enable asymmetric keys support" |
| 37 | depends on INTEGRITY_SIGNATURE |
| 38 | default n |
| 39 | select ASYMMETRIC_KEY_TYPE |
| 40 | select ASYMMETRIC_PUBLIC_KEY_SUBTYPE |
| 41 | select PUBLIC_KEY_ALGO_RSA |
| 42 | select X509_CERTIFICATE_PARSER |
| 43 | help |
| 44 | This option enables digital signature verification using |
| 45 | asymmetric keys. |
| 46 | |
| Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 47 | source security/integrity/ima/Kconfig |
| Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 48 | source security/integrity/evm/Kconfig |