# config [31mCONFIG_INTEGRITY[0m bool "Integrity subsystem" depends on [31mCONFIG_SECURITY[0m default y help This option enables the integrity subsystem, which is comprised of a number of different components including the Integrity Measurement Architecture ([31mCONFIG_IMA[0m), Extended Verification Module ([31mCONFIG_EVM[0m), [31mCONFIG_IMA[0m-appraisal extension, digital signature verification extension and audit measurement log support. Each of these components can be enabled/disabled separately. Refer to the individual components for additional details. if [31mCONFIG_INTEGRITY[0m config [31mCONFIG_INTEGRITY_SIGNATURE[0m bool "Digital signature verification using multiple keyrings" depends on [31mCONFIG_KEYS[0m default n select [31mCONFIG_SIGNATURE[0m help This option enables digital signature verification support using multiple keyrings. It defines separate keyrings for each of the different use cases - evm, ima, and modules. Different keyrings improves search performance, but also allow to "lock" certain keyring to prevent adding new keys. This is useful for evm and module keyrings, when keys are usually only added from initramfs. config [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m bool "Enable asymmetric keys support" depends on [31mCONFIG_INTEGRITY_SIGNATURE[0m default n select [31mCONFIG_ASYMMETRIC_KEY_TYPE[0m select [31mCONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE[0m select [31mCONFIG_CRYPTO_RSA[0m select [31mCONFIG_X509_CERTIFICATE_PARSER[0m help This option enables digital signature verification using asymmetric keys. config [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m bool "Require all keys on the integrity keyrings be signed" depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m default y help This option requires that all keys added to the .ima and .evm keyrings be signed by a key on the system trusted keyring. config [31mCONFIG_INTEGRITY_AUDIT[0m bool "Enables integrity auditing support " depends on [31mCONFIG_AUDIT[0m default y help In addition to enabling integrity auditing support, this option adds a kernel parameter 'integrity_audit', which controls the level of integrity auditing messages. 0 - basic integrity auditing messages (default) 1 - additional integrity auditing messages Additional informational integrity auditing messages would be enabled by specifying 'integrity_audit=1' on the kernel command line. source security/integrity/ima/Kconfig source security/integrity/evm/Kconfig endif # if [31mCONFIG_INTEGRITY[0m |