| # SPDX-License-Identifier: GPL-2.0-only | |
| # | |
| # Integrity Policy Enforcement (IPE) configuration | |
| # | |
| menuconfig SECURITY_IPE | |
| bool "Integrity Policy Enforcement (IPE)" | |
| depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL | |
| select PKCS7_MESSAGE_PARSER | |
| select SYSTEM_DATA_VERIFICATION | |
| select IPE_PROP_DM_VERITY if DM_VERITY | |
| select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG | |
| select IPE_PROP_FS_VERITY if FS_VERITY | |
| select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES | |
| help | |
| This option enables the Integrity Policy Enforcement LSM | |
| allowing users to define a policy to enforce a trust-based access | |
| control. A key feature of IPE is a customizable policy to allow | |
| admins to reconfigure trust requirements on the fly. | |
| If unsure, answer N. | |
| if SECURITY_IPE | |
| config IPE_BOOT_POLICY | |
| string "Integrity policy to apply on system startup" | |
| help | |
| This option specifies a filepath to an IPE policy that is compiled | |
| into the kernel. This policy will be enforced until a policy update | |
| is deployed via the $securityfs/ipe/policies/$policy_name/active | |
| interface. | |
| If unsure, leave blank. | |
| config IPE_POLICY_SIG_SECONDARY_KEYRING | |
| bool "IPE policy update verification with secondary keyring" | |
| default y | |
| depends on SECONDARY_TRUSTED_KEYRING | |
| help | |
| Also allow the secondary trusted keyring to verify IPE policy | |
| updates. | |
| If unsure, answer Y. | |
| config IPE_POLICY_SIG_PLATFORM_KEYRING | |
| bool "IPE policy update verification with platform keyring" | |
| default y | |
| depends on INTEGRITY_PLATFORM_KEYRING | |
| help | |
| Also allow the platform keyring to verify IPE policy updates. | |
| If unsure, answer Y. | |
| menu "IPE Trust Providers" | |
| config IPE_PROP_DM_VERITY | |
| bool "Enable support for dm-verity based on root hash" | |
| depends on DM_VERITY | |
| help | |
| This option enables the 'dmverity_roothash' property within IPE | |
| policies. The property evaluates to TRUE when a file from a dm-verity | |
| volume is evaluated, and the volume's root hash matches the value | |
| supplied in the policy. | |
| config IPE_PROP_DM_VERITY_SIGNATURE | |
| bool "Enable support for dm-verity based on root hash signature" | |
| depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG | |
| help | |
| This option enables the 'dmverity_signature' property within IPE | |
| policies. The property evaluates to TRUE when a file from a dm-verity | |
| volume, which has been mounted with a valid signed root hash, | |
| is evaluated. | |
| If unsure, answer Y. | |
| config IPE_PROP_FS_VERITY | |
| bool "Enable support for fs-verity based on file digest" | |
| depends on FS_VERITY | |
| help | |
| This option enables the 'fsverity_digest' property within IPE | |
| policies. The property evaluates to TRUE when a file is fsverity | |
| enabled and its digest matches the supplied digest value in the | |
| policy. | |
| if unsure, answer Y. | |
| config IPE_PROP_FS_VERITY_BUILTIN_SIG | |
| bool "Enable support for fs-verity based on builtin signature" | |
| depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES | |
| help | |
| This option enables the 'fsverity_signature' property within IPE | |
| policies. The property evaluates to TRUE when a file is fsverity | |
| enabled and it has a valid builtin signature whose signing cert | |
| is in the .fs-verity keyring. | |
| if unsure, answer Y. | |
| endmenu | |
| config SECURITY_IPE_KUNIT_TEST | |
| bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS | |
| depends on KUNIT=y | |
| default KUNIT_ALL_TESTS | |
| help | |
| This builds the IPE KUnit tests. | |
| KUnit tests run during boot and output the results to the debug log | |
| in TAP format (https://testanything.org/). Only useful for kernel devs | |
| running KUnit test harness and are not for inclusion into a | |
| production build. | |
| For more information on KUnit and unit tests in general please refer | |
| to the KUnit documentation in Documentation/dev-tools/kunit/. | |
| If unsure, say N. | |
| endif |