Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | # IBM Integrity Measurement Architecture |
| 2 | # |
| 3 | config IMA |
| 4 | bool "Integrity Measurement Architecture(IMA)" |
Mimi Zohar | 6c21a7f | 2009-10-22 17:30:13 -0400 | [diff] [blame] | 5 | depends on SECURITY |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 6 | select INTEGRITY |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 7 | select SECURITYFS |
| 8 | select CRYPTO |
| 9 | select CRYPTO_HMAC |
| 10 | select CRYPTO_MD5 |
| 11 | select CRYPTO_SHA1 |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 12 | select CRYPTO_HASH_INFO |
Fabio Estevam | f4a0391 | 2012-01-05 12:49:54 -0200 | [diff] [blame] | 13 | select TCG_TPM if HAS_IOMEM && !UML |
Randy Dunlap | a69f158 | 2012-02-24 11:28:05 -0800 | [diff] [blame] | 14 | select TCG_TIS if TCG_TPM && X86 |
Kent Yoder | 20328b5 | 2012-08-22 15:01:47 -0500 | [diff] [blame] | 15 | select TCG_IBMVTPM if TCG_TPM && PPC64 |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 16 | help |
| 17 | The Trusted Computing Group(TCG) runtime Integrity |
| 18 | Measurement Architecture(IMA) maintains a list of hash |
| 19 | values of executables and other sensitive system files, |
| 20 | as they are read or executed. If an attacker manages |
| 21 | to change the contents of an important system file |
| 22 | being measured, we can tell. |
| 23 | |
| 24 | If your system has a TPM chip, then IMA also maintains |
| 25 | an aggregate integrity value over this list inside the |
| 26 | TPM hardware, so that the TPM can prove to a third party |
| 27 | whether or not critical system files have been modified. |
| 28 | Read <http://www.usenix.org/events/sec04/tech/sailer.html> |
| 29 | to learn more about IMA. |
| 30 | If unsure, say N. |
| 31 | |
| 32 | config IMA_MEASURE_PCR_IDX |
| 33 | int |
| 34 | depends on IMA |
| 35 | range 8 14 |
| 36 | default 10 |
| 37 | help |
| 38 | IMA_MEASURE_PCR_IDX determines the TPM PCR register index |
| 39 | that IMA uses to maintain the integrity aggregate of the |
| 40 | measurement list. If unsure, use the default 10. |
| 41 | |
Mimi Zohar | 4af4662 | 2009-02-04 09:07:00 -0500 | [diff] [blame] | 42 | config IMA_LSM_RULES |
| 43 | bool |
Randy Dunlap | b53fab9 | 2009-02-12 09:54:14 -0800 | [diff] [blame] | 44 | depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK) |
Mimi Zohar | 4af4662 | 2009-02-04 09:07:00 -0500 | [diff] [blame] | 45 | default y |
| 46 | help |
Randy Dunlap | b53fab9 | 2009-02-12 09:54:14 -0800 | [diff] [blame] | 47 | Disabling this option will disregard LSM based policy rules. |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 48 | |
Mimi Zohar | 4286587 | 2013-06-07 12:16:34 +0200 | [diff] [blame] | 49 | choice |
| 50 | prompt "Default template" |
| 51 | default IMA_NG_TEMPLATE |
| 52 | depends on IMA |
| 53 | help |
| 54 | Select the default IMA measurement template. |
| 55 | |
| 56 | The original 'ima' measurement list template contains a |
| 57 | hash, defined as 20 bytes, and a null terminated pathname, |
| 58 | limited to 255 characters. The 'ima-ng' measurement list |
| 59 | template permits both larger hash digests and longer |
| 60 | pathnames. |
| 61 | |
| 62 | config IMA_TEMPLATE |
| 63 | bool "ima" |
| 64 | config IMA_NG_TEMPLATE |
| 65 | bool "ima-ng (default)" |
Mimi Zohar | bcbc9b0 | 2013-07-23 11:15:00 -0400 | [diff] [blame] | 66 | config IMA_SIG_TEMPLATE |
| 67 | bool "ima-sig" |
Mimi Zohar | 4286587 | 2013-06-07 12:16:34 +0200 | [diff] [blame] | 68 | endchoice |
| 69 | |
| 70 | config IMA_DEFAULT_TEMPLATE |
| 71 | string |
| 72 | depends on IMA |
| 73 | default "ima" if IMA_TEMPLATE |
| 74 | default "ima-ng" if IMA_NG_TEMPLATE |
Mimi Zohar | bcbc9b0 | 2013-07-23 11:15:00 -0400 | [diff] [blame] | 75 | default "ima-sig" if IMA_SIG_TEMPLATE |
Mimi Zohar | 4286587 | 2013-06-07 12:16:34 +0200 | [diff] [blame] | 76 | |
Mimi Zohar | e7a2ad7 | 2013-06-07 12:16:37 +0200 | [diff] [blame] | 77 | choice |
| 78 | prompt "Default integrity hash algorithm" |
| 79 | default IMA_DEFAULT_HASH_SHA1 |
| 80 | depends on IMA |
| 81 | help |
| 82 | Select the default hash algorithm used for the measurement |
| 83 | list, integrity appraisal and audit log. The compiled default |
| 84 | hash algorithm can be overwritten using the kernel command |
| 85 | line 'ima_hash=' option. |
| 86 | |
| 87 | config IMA_DEFAULT_HASH_SHA1 |
| 88 | bool "SHA1 (default)" |
| 89 | depends on CRYPTO_SHA1 |
| 90 | |
| 91 | config IMA_DEFAULT_HASH_SHA256 |
| 92 | bool "SHA256" |
| 93 | depends on CRYPTO_SHA256 && !IMA_TEMPLATE |
| 94 | |
| 95 | config IMA_DEFAULT_HASH_SHA512 |
| 96 | bool "SHA512" |
| 97 | depends on CRYPTO_SHA512 && !IMA_TEMPLATE |
| 98 | |
| 99 | config IMA_DEFAULT_HASH_WP512 |
| 100 | bool "WP512" |
| 101 | depends on CRYPTO_WP512 && !IMA_TEMPLATE |
| 102 | endchoice |
| 103 | |
| 104 | config IMA_DEFAULT_HASH |
| 105 | string |
| 106 | depends on IMA |
| 107 | default "sha1" if IMA_DEFAULT_HASH_SHA1 |
| 108 | default "sha256" if IMA_DEFAULT_HASH_SHA256 |
| 109 | default "sha512" if IMA_DEFAULT_HASH_SHA512 |
| 110 | default "wp512" if IMA_DEFAULT_HASH_WP512 |
| 111 | |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 112 | config IMA_APPRAISE |
| 113 | bool "Appraise integrity measurements" |
| 114 | depends on IMA |
| 115 | default n |
| 116 | help |
| 117 | This option enables local measurement integrity appraisal. |
| 118 | It requires the system to be labeled with a security extended |
| 119 | attribute containing the file hash measurement. To protect |
| 120 | the security extended attributes from offline attack, enable |
| 121 | and configure EVM. |
| 122 | |
| 123 | For more information on integrity appraisal refer to: |
| 124 | <http://linux-ima.sourceforge.net> |
| 125 | If unsure, say N. |