| # SPDX-License-Identifier: GPL-2.0-only |
| # |
| # Integrity Policy Enforcement (IPE) configuration |
| # |
| |
| menuconfig SECURITY_IPE |
| bool "Integrity Policy Enforcement (IPE)" |
| depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL |
| select PKCS7_MESSAGE_PARSER |
| select SYSTEM_DATA_VERIFICATION |
| select IPE_PROP_DM_VERITY if DM_VERITY |
| select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG |
| select IPE_PROP_FS_VERITY if FS_VERITY |
| select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES |
| help |
| This option enables the Integrity Policy Enforcement LSM |
| allowing users to define a policy to enforce a trust-based access |
| control. A key feature of IPE is a customizable policy to allow |
| admins to reconfigure trust requirements on the fly. |
| |
| If unsure, answer N. |
| |
| if SECURITY_IPE |
| config IPE_BOOT_POLICY |
| string "Integrity policy to apply on system startup" |
| help |
| This option specifies a filepath to an IPE policy that is compiled |
| into the kernel. This policy will be enforced until a policy update |
| is deployed via the $securityfs/ipe/policies/$policy_name/active |
| interface. |
| |
| If unsure, leave blank. |
| |
| config IPE_POLICY_SIG_SECONDARY_KEYRING |
| bool "IPE policy update verification with secondary keyring" |
| default y |
| depends on SECONDARY_TRUSTED_KEYRING |
| help |
| Also allow the secondary trusted keyring to verify IPE policy |
| updates. |
| |
| If unsure, answer Y. |
| |
| config IPE_POLICY_SIG_PLATFORM_KEYRING |
| bool "IPE policy update verification with platform keyring" |
| default y |
| depends on INTEGRITY_PLATFORM_KEYRING |
| help |
| Also allow the platform keyring to verify IPE policy updates. |
| |
| If unsure, answer Y. |
| |
| menu "IPE Trust Providers" |
| |
| config IPE_PROP_DM_VERITY |
| bool "Enable support for dm-verity based on root hash" |
| depends on DM_VERITY |
| help |
| This option enables the 'dmverity_roothash' property within IPE |
| policies. The property evaluates to TRUE when a file from a dm-verity |
| volume is evaluated, and the volume's root hash matches the value |
| supplied in the policy. |
| |
| config IPE_PROP_DM_VERITY_SIGNATURE |
| bool "Enable support for dm-verity based on root hash signature" |
| depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG |
| help |
| This option enables the 'dmverity_signature' property within IPE |
| policies. The property evaluates to TRUE when a file from a dm-verity |
| volume, which has been mounted with a valid signed root hash, |
| is evaluated. |
| |
| If unsure, answer Y. |
| |
| config IPE_PROP_FS_VERITY |
| bool "Enable support for fs-verity based on file digest" |
| depends on FS_VERITY |
| help |
| This option enables the 'fsverity_digest' property within IPE |
| policies. The property evaluates to TRUE when a file is fsverity |
| enabled and its digest matches the supplied digest value in the |
| policy. |
| |
| if unsure, answer Y. |
| |
| config IPE_PROP_FS_VERITY_BUILTIN_SIG |
| bool "Enable support for fs-verity based on builtin signature" |
| depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES |
| help |
| This option enables the 'fsverity_signature' property within IPE |
| policies. The property evaluates to TRUE when a file is fsverity |
| enabled and it has a valid builtin signature whose signing cert |
| is in the .fs-verity keyring. |
| |
| if unsure, answer Y. |
| |
| endmenu |
| |
| config SECURITY_IPE_KUNIT_TEST |
| bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS |
| depends on KUNIT=y |
| default KUNIT_ALL_TESTS |
| help |
| This builds the IPE KUnit tests. |
| |
| KUnit tests run during boot and output the results to the debug log |
| in TAP format (https://testanything.org/). Only useful for kernel devs |
| running KUnit test harness and are not for inclusion into a |
| production build. |
| |
| For more information on KUnit and unit tests in general please refer |
| to the KUnit documentation in Documentation/dev-tools/kunit/. |
| |
| If unsure, say N. |
| |
| endif |
