# IBM Integrity Measurement Architecture
#
config [31mCONFIG_IMA[0m
bool "Integrity Measurement Architecture(IMA)"
select [31mCONFIG_SECURITYFS[0m
select [31mCONFIG_CRYPTO[0m
select [31mCONFIG_CRYPTO_HMAC[0m
select [31mCONFIG_CRYPTO_MD5[0m
select [31mCONFIG_CRYPTO_SHA1[0m
select [31mCONFIG_CRYPTO_HASH_INFO[0m
select [31mCONFIG_TCG_TPM[0m if [31mCONFIG_HAS_IOMEM[0m && ![31mCONFIG_UML[0m
select [31mCONFIG_TCG_TIS[0m if [31mCONFIG_TCG_TPM[0m && [31mCONFIG_X86[0m
select [31mCONFIG_TCG_IBMVTPM[0m if [31mCONFIG_TCG_TPM[0m && [31mCONFIG_PPC_PSERIES[0m
help
The Trusted Computing Group(TCG) runtime Integrity
Measurement Architecture([31mCONFIG_IMA[0m) maintains a list of hash
values of executables and other sensitive system files,
as they are read or executed. If an attacker manages
to change the contents of an important system file
being measured, we can tell.
If your system has a TPM chip, then [31mCONFIG_IMA[0m also maintains
an aggregate integrity value over this list inside the
TPM hardware, so that the TPM can prove to a third party
whether or not critical system files have been modified.
Read <http://www.usenix.org/events/sec04/tech/sailer.html>
to learn more about [31mCONFIG_IMA[0m.
If unsure, say N.
config [31mCONFIG_IMA_KEXEC[0m
bool "Enable carrying the IMA measurement list across a soft boot"
depends on [31mCONFIG_IMA[0m && [31mCONFIG_TCG_TPM[0m && [31mCONFIG_HAVE_IMA_KEXEC[0m
default n
help
TPM PCRs are only reset on a hard reboot. In order to validate
a TPM's quote after a soft boot, the [31mCONFIG_IMA[0m measurement list of the
running kernel must be saved and restored on boot.
Depending on the [31mCONFIG_IMA[0m policy, the measurement list can grow to
be very large.
config [31mCONFIG_IMA_MEASURE_PCR_IDX[0m
int
depends on [31mCONFIG_IMA[0m
range 8 14
default 10
help
[31mCONFIG_IMA_MEASURE_PCR_IDX[0m determines the TPM PCR register index
that [31mCONFIG_IMA[0m uses to maintain the integrity aggregate of the
measurement list. If unsure, use the default 10.
config [31mCONFIG_IMA_LSM_RULES[0m
bool
depends on [31mCONFIG_IMA[0m && [31mCONFIG_AUDIT[0m && ([31mCONFIG_SECURITY_SELINUX[0m || [31mCONFIG_SECURITY_SMACK[0m)
default y
help
Disabling this option will disregard [31mCONFIG_LSM[0m based policy rules.
choice
prompt "Default template"
default [31mCONFIG_IMA_NG_TEMPLATE[0m
depends on [31mCONFIG_IMA[0m
help
Select the default [31mCONFIG_IMA[0m measurement template.
The original 'ima' measurement list template contains a
hash, defined as 20 bytes, and a null terminated pathname,
limited to 255 characters. The 'ima-ng' measurement list
template permits both larger hash digests and longer
pathnames.
config [31mCONFIG_IMA_TEMPLATE[0m
bool "ima"
config [31mCONFIG_IMA_NG_TEMPLATE[0m
bool "ima-ng (default)"
config [31mCONFIG_IMA_SIG_TEMPLATE[0m
bool "ima-sig"
endchoice
config [31mCONFIG_IMA_DEFAULT_TEMPLATE[0m
string
depends on [31mCONFIG_IMA[0m
default "ima" if [31mCONFIG_IMA_TEMPLATE[0m
default "ima-ng" if [31mCONFIG_IMA_NG_TEMPLATE[0m
default "ima-sig" if [31mCONFIG_IMA_SIG_TEMPLATE[0m
choice
prompt "Default integrity hash algorithm"
default [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
depends on [31mCONFIG_IMA[0m
help
Select the default hash algorithm used for the measurement
list, integrity appraisal and audit log. The compiled default
hash algorithm can be overwritten using the kernel command
line 'ima_hash=' option.
config [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
bool "SHA1 (default)"
depends on [31mCONFIG_CRYPTO_SHA1[0m
config [31mCONFIG_IMA_DEFAULT_HASH_SHA256[0m
bool "SHA256"
depends on [31mCONFIG_CRYPTO_SHA256[0m && ![31mCONFIG_IMA_TEMPLATE[0m
config [31mCONFIG_IMA_DEFAULT_HASH_SHA512[0m
bool "SHA512"
depends on [31mCONFIG_CRYPTO_SHA512[0m && ![31mCONFIG_IMA_TEMPLATE[0m
config [31mCONFIG_IMA_DEFAULT_HASH_WP512[0m
bool "WP512"
depends on [31mCONFIG_CRYPTO_WP512[0m && ![31mCONFIG_IMA_TEMPLATE[0m
endchoice
config [31mCONFIG_IMA_DEFAULT_HASH[0m
string
depends on [31mCONFIG_IMA[0m
default "sha1" if [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
default "sha256" if [31mCONFIG_IMA_DEFAULT_HASH_SHA256[0m
default "sha512" if [31mCONFIG_IMA_DEFAULT_HASH_SHA512[0m
default "wp512" if [31mCONFIG_IMA_DEFAULT_HASH_WP512[0m
config [31mCONFIG_IMA_WRITE_POLICY[0m
bool "Enable multiple writes to the IMA policy"
depends on [31mCONFIG_IMA[0m
default n
help
[31mCONFIG_IMA[0m policy can now be updated multiple times. The new rules get
appended to the original policy. Have in mind that the rules are
scanned in FIFO order so be careful when you design and add new ones.
If unsure, say N.
config [31mCONFIG_IMA_READ_POLICY[0m
bool "Enable reading back the current IMA policy"
depends on [31mCONFIG_IMA[0m
default y if [31mCONFIG_IMA_WRITE_POLICY[0m
default n if ![31mCONFIG_IMA_WRITE_POLICY[0m
help
It is often useful to be able to read back the [31mCONFIG_IMA[0m policy. It is
even more important after introducing CONFIG_IMA_WRITE_POLICY.
This option allows the root user to see the current policy rules.
config [31mCONFIG_IMA_APPRAISE[0m
bool "Appraise integrity measurements"
depends on [31mCONFIG_IMA[0m
default n
help
This option enables local measurement integrity appraisal.
It requires the system to be labeled with a security extended
attribute containing the file hash measurement. To protect
the security extended attributes from offline attack, enable
and configure [31mCONFIG_EVM[0m.
For more information on integrity appraisal refer to:
<http://linux-ima.sourceforge.net>
If unsure, say N.
config [31mCONFIG_IMA_TRUSTED_KEYRING[0m
bool "Require all keys on the .ima keyring be signed (deprecated)"
depends on [31mCONFIG_IMA_APPRAISE[0m && [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
select [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
default y
help
This option requires that all keys added to the .ima
keyring be signed by a key on the system trusted keyring.
This option is deprecated in favor of [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
config [31mCONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY[0m
bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)"
depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_SECONDARY_TRUSTED_KEYRING[0m
depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
select [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
default n
help
Keys may be added to the [31mCONFIG_IMA[0m or [31mCONFIG_IMA[0m blacklist keyrings, if the
key is validly signed by a CA cert in the system built-in or
secondary trusted keyrings.
Intermediate keys between those the kernel has compiled in and the
[31mCONFIG_IMA[0m keys to be added may be added to the system secondary keyring,
provided they are validly signed by a key already resident in the
built-in or secondary trusted keyrings.
config [31mCONFIG_IMA_BLACKLIST_KEYRING[0m
bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"
depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_IMA_TRUSTED_KEYRING[0m
default n
help
This option creates an [31mCONFIG_IMA[0m blacklist keyring, which contains all
revoked [31mCONFIG_IMA[0m keys. It is consulted before any other keyring. If
the search is successful the requested operation is rejected and
an error is returned to the caller.
config [31mCONFIG_IMA_LOAD_X509[0m
bool "Load X509 certificate onto the '.ima' trusted keyring"
depends on [31mCONFIG_IMA_TRUSTED_KEYRING[0m
default n
help
File signature verification is based on the public keys
loaded on the .ima trusted keyring. These public keys are
X509 certificates signed by a trusted key on the
.system keyring. This option enables X509 certificate
loading from the kernel onto the '.ima' trusted keyring.
config [31mCONFIG_IMA_X509_PATH[0m
string "IMA X509 certificate path"
depends on [31mCONFIG_IMA_LOAD_X509[0m
default "/etc/keys/x509_ima.der"
help
This option defines [31mCONFIG_IMA[0m X509 certificate path.
config [31mCONFIG_IMA_APPRAISE_SIGNED_INIT[0m
bool "Require signed user-space initialization"
depends on [31mCONFIG_IMA_LOAD_X509[0m
default n
help
This option requires user-space init to be signed.