| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576 |
- # SPDX-License-Identifier: GPL-2.0-only
- config EVM
- bool "EVM support"
- select KEYS
- select ENCRYPTED_KEYS
- select CRYPTO_HMAC
- select CRYPTO_SHA1
- select CRYPTO_HASH_INFO
- select SECURITY_PATH
- default n
- help
- EVM protects a file's security extended attributes against
- integrity attacks.
- If you are unsure how to answer this question, answer N.
- config EVM_ATTR_FSUUID
- bool "FSUUID (version 2)"
- default y
- depends on EVM
- help
- Include filesystem UUID for HMAC calculation.
- Default value is 'selected', which is former version 2.
- if 'not selected', it is former version 1
- WARNING: changing the HMAC calculation method or adding
- additional info to the calculation, requires existing EVM
- labeled file systems to be relabeled.
- config EVM_EXTRA_SMACK_XATTRS
- bool "Additional SMACK xattrs"
- depends on EVM && SECURITY_SMACK
- default n
- help
- Include additional SMACK xattrs for HMAC calculation.
- In addition to the original security xattrs (eg. security.selinux,
- security.SMACK64, security.capability, and security.ima) included
- in the HMAC calculation, enabling this option includes newly defined
- Smack xattrs: security.SMACK64EXEC, security.SMACK64TRANSMUTE and
- security.SMACK64MMAP.
- WARNING: changing the HMAC calculation method or adding
- additional info to the calculation, requires existing EVM
- labeled file systems to be relabeled.
- config EVM_ADD_XATTRS
- bool "Add additional EVM extended attributes at runtime"
- depends on EVM
- default n
- help
- Allow userland to provide additional xattrs for HMAC calculation.
- When this option is enabled, root can add additional xattrs to the
- list used by EVM by writing them into
- /sys/kernel/security/integrity/evm/evm_xattrs.
- config EVM_LOAD_X509
- bool "Load an X509 certificate onto the '.evm' trusted keyring"
- depends on EVM && INTEGRITY_TRUSTED_KEYRING
- default n
- help
- Load an X509 certificate onto the '.evm' trusted keyring.
- This option enables X509 certificate loading from the kernel
- onto the '.evm' trusted keyring. A public key can be used to
- verify EVM integrity starting from the 'init' process. The
- key must have digitalSignature usage set.
- config EVM_X509_PATH
- string "EVM X509 certificate path"
- depends on EVM_LOAD_X509
- default "/etc/keys/x509_evm.der"
- help
- This option defines X509 certificate path.
|
