| David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 1 | # |
| 2 | # Key management configuration |
| 3 | # |
| 4 | |
| 5 | config KEYS |
| 6 | bool "Enable access key retention support" |
| David Howells | b2a4df2 | 2013-09-24 10:35:18 +0100 | [diff] [blame] | 7 | select ASSOCIATIVE_ARRAY |
| David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 8 | help |
| 9 | This option provides support for retaining authentication tokens and |
| 10 | access keys in the kernel. |
| 11 | |
| 12 | It also includes provision of methods by which such keys might be |
| 13 | associated with a process so that network filesystems, encryption |
| 14 | support and the like can find them. |
| 15 | |
| 16 | Furthermore, a special type of key is available that acts as keyring: |
| 17 | a searchable sequence of keys. Each process is equipped with access |
| 18 | to five standard keyrings: UID-specific, GID-specific, session, |
| 19 | process and thread. |
| 20 | |
| 21 | If you are unsure as to whether this is required, answer N. |
| 22 | |
| David Howells | ab3c358 | 2013-09-24 10:35:18 +0100 | [diff] [blame^] | 23 | config BIG_KEYS |
| 24 | tristate "Large payload keys" |
| 25 | depends on KEYS |
| 26 | depends on TMPFS |
| 27 | help |
| 28 | This option provides support for holding large keys within the kernel |
| 29 | (for example Kerberos ticket caches). The data may be stored out to |
| 30 | swapspace by tmpfs. |
| 31 | |
| 32 | If you are unsure as to whether this is required, answer N. |
| 33 | |
| David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 34 | config TRUSTED_KEYS |
| 35 | tristate "TRUSTED KEYS" |
| 36 | depends on KEYS && TCG_TPM |
| 37 | select CRYPTO |
| 38 | select CRYPTO_HMAC |
| 39 | select CRYPTO_SHA1 |
| 40 | help |
| 41 | This option provides support for creating, sealing, and unsealing |
| 42 | keys in the kernel. Trusted keys are random number symmetric keys, |
| 43 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, |
| 44 | if the boot PCRs and other criteria match. Userspace will only ever |
| 45 | see encrypted blobs. |
| 46 | |
| 47 | If you are unsure as to whether this is required, answer N. |
| 48 | |
| 49 | config ENCRYPTED_KEYS |
| 50 | tristate "ENCRYPTED KEYS" |
| 51 | depends on KEYS |
| 52 | select CRYPTO |
| 53 | select CRYPTO_HMAC |
| 54 | select CRYPTO_AES |
| 55 | select CRYPTO_CBC |
| 56 | select CRYPTO_SHA256 |
| 57 | select CRYPTO_RNG |
| 58 | help |
| 59 | This option provides support for create/encrypting/decrypting keys |
| 60 | in the kernel. Encrypted keys are kernel generated random numbers, |
| 61 | which are encrypted/decrypted with a 'master' symmetric key. The |
| 62 | 'master' key can be either a trusted-key or user-key type. |
| 63 | Userspace only ever sees/stores encrypted blobs. |
| 64 | |
| 65 | If you are unsure as to whether this is required, answer N. |
| 66 | |
| 67 | config KEYS_DEBUG_PROC_KEYS |
| 68 | bool "Enable the /proc/keys file by which keys may be viewed" |
| 69 | depends on KEYS |
| 70 | help |
| 71 | This option turns on support for the /proc/keys file - through which |
| 72 | can be listed all the keys on the system that are viewable by the |
| 73 | reading process. |
| 74 | |
| 75 | The only keys included in the list are those that grant View |
| 76 | permission to the reading process whether or not it possesses them. |
| 77 | Note that LSM security checks are still performed, and may further |
| 78 | filter out keys that the current process is not authorised to view. |
| 79 | |
| 80 | Only key attributes are listed here; key payloads are not included in |
| 81 | the resulting table. |
| 82 | |
| 83 | If you are unsure as to whether this is required, answer N. |