Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118# SPDX-License-Identifier: GPL-2.0-only## Integrity Policy Enforcement (IPE) configuration#
menuconfig SECURITY_IPE bool "Integrity Policy Enforcement (IPE)" depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL select CRYPTO_LIB_SHA256 select PKCS7_MESSAGE_PARSER select SYSTEM_DATA_VERIFICATION select IPE_PROP_DM_VERITY if DM_VERITY select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG select IPE_PROP_FS_VERITY if FS_VERITY select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES help This option enables the Integrity Policy Enforcement LSM allowing users to define a policy to enforce a trust-based access control. A key feature of IPE is a customizable policy to allow admins to reconfigure trust requirements on the fly.
If unsure, answer N.
if SECURITY_IPEconfig IPE_BOOT_POLICY string "Integrity policy to apply on system startup" help This option specifies a filepath to an IPE policy that is compiled into the kernel. This policy will be enforced until a policy update is deployed via the $securityfs/ipe/policies/$policy_name/active interface.
If unsure, leave blank.
config IPE_POLICY_SIG_SECONDARY_KEYRING bool "IPE policy update verification with secondary keyring" default y depends on SECONDARY_TRUSTED_KEYRING help Also allow the secondary trusted keyring to verify IPE policy updates.
If unsure, answer Y.
config IPE_POLICY_SIG_PLATFORM_KEYRING bool "IPE policy update verification with platform keyring" default y depends on INTEGRITY_PLATFORM_KEYRING help Also allow the platform keyring to verify IPE policy updates.
If unsure, answer Y.
menu "IPE Trust Providers"
config IPE_PROP_DM_VERITY bool "Enable support for dm-verity based on root hash" depends on DM_VERITY help This option enables the 'dmverity_roothash' property within IPE policies. The property evaluates to TRUE when a file from a dm-verity volume is evaluated, and the volume's root hash matches the value supplied in the policy.
config IPE_PROP_DM_VERITY_SIGNATURE bool "Enable support for dm-verity based on root hash signature" depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG help This option enables the 'dmverity_signature' property within IPE policies. The property evaluates to TRUE when a file from a dm-verity volume, which has been mounted with a valid signed root hash, is evaluated.
If unsure, answer Y.
config IPE_PROP_FS_VERITY bool "Enable support for fs-verity based on file digest" depends on FS_VERITY help This option enables the 'fsverity_digest' property within IPE policies. The property evaluates to TRUE when a file is fsverity enabled and its digest matches the supplied digest value in the policy.
if unsure, answer Y.
config IPE_PROP_FS_VERITY_BUILTIN_SIG bool "Enable support for fs-verity based on builtin signature" depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES help This option enables the 'fsverity_signature' property within IPE policies. The property evaluates to TRUE when a file is fsverity enabled and it has a valid builtin signature whose signing cert is in the .fs-verity keyring.
if unsure, answer Y.
endmenu
config SECURITY_IPE_KUNIT_TEST bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS depends on KUNIT=y default KUNIT_ALL_TESTS help This builds the IPE KUnit tests.
KUnit tests run during boot and output the results to the debug log in TAP format (https://testanything.org/). Only useful for kernel devs running KUnit test harness and are not for inclusion into a production build.
For more information on KUnit and unit tests in general please refer to the KUnit documentation in Documentation/dev-tools/kunit/.
If unsure, say N.
endif