# SPDX-License-Identifier: GPL-2.0-only
# IBM Integrity Measurement Architecture
#
config [31mCONFIG_IMA[0m
bool "Integrity Measurement Architecture(IMA)"
select [31mCONFIG_SECURITYFS[0m
select [31mCONFIG_CRYPTO[0m
select [31mCONFIG_CRYPTO_HMAC[0m
select [31mCONFIG_CRYPTO_MD5[0m
select [31mCONFIG_CRYPTO_SHA1[0m
select [31mCONFIG_CRYPTO_HASH_INFO[0m
select [31mCONFIG_TCG_TPM[0m if [31mCONFIG_HAS_IOMEM[0m && ![31mCONFIG_UML[0m
select [31mCONFIG_TCG_TIS[0m if [31mCONFIG_TCG_TPM[0m && [31mCONFIG_X86[0m
select [31mCONFIG_TCG_CRB[0m if [31mCONFIG_TCG_TPM[0m && [31mCONFIG_ACPI[0m
select [31mCONFIG_TCG_IBMVTPM[0m if [31mCONFIG_TCG_TPM[0m && [31mCONFIG_PPC_PSERIES[0m
select [31mCONFIG_INTEGRITY_AUDIT[0m if [31mCONFIG_AUDIT[0m
help
The Trusted Computing Group(TCG) runtime Integrity
Measurement Architecture([31mCONFIG_IMA[0m) maintains a list of hash
values of executables and other sensitive system files,
as they are read or executed. If an attacker manages
to change the contents of an important system file
being measured, we can tell.
If your system has a TPM chip, then [31mCONFIG_IMA[0m also maintains
an aggregate integrity value over this list inside the
TPM hardware, so that the TPM can prove to a third party
whether or not critical system files have been modified.
Read <http://www.usenix.org/events/sec04/tech/sailer.html>
to learn more about [31mCONFIG_IMA[0m.
If unsure, say N.
config [31mCONFIG_IMA_KEXEC[0m
bool "Enable carrying the IMA measurement list across a soft boot"
depends on [31mCONFIG_IMA[0m && [31mCONFIG_TCG_TPM[0m && [31mCONFIG_HAVE_IMA_KEXEC[0m
default n
help
TPM PCRs are only reset on a hard reboot. In order to validate
a TPM's quote after a soft boot, the [31mCONFIG_IMA[0m measurement list of the
running kernel must be saved and restored on boot.
Depending on the [31mCONFIG_IMA[0m policy, the measurement list can grow to
be very large.
config [31mCONFIG_IMA_MEASURE_PCR_IDX[0m
int
depends on [31mCONFIG_IMA[0m
range 8 14
default 10
help
[31mCONFIG_IMA_MEASURE_PCR_IDX[0m determines the TPM PCR register index
that [31mCONFIG_IMA[0m uses to maintain the integrity aggregate of the
measurement list. If unsure, use the default 10.
config [31mCONFIG_IMA_LSM_RULES[0m
bool
depends on [31mCONFIG_IMA[0m && [31mCONFIG_AUDIT[0m && ([31mCONFIG_SECURITY_SELINUX[0m || [31mCONFIG_SECURITY_SMACK[0m)
default y
help
Disabling this option will disregard [31mCONFIG_LSM[0m based policy rules.
choice
prompt "Default template"
default [31mCONFIG_IMA_NG_TEMPLATE[0m
depends on [31mCONFIG_IMA[0m
help
Select the default [31mCONFIG_IMA[0m measurement template.
The original 'ima' measurement list template contains a
hash, defined as 20 bytes, and a null terminated pathname,
limited to 255 characters. The 'ima-ng' measurement list
template permits both larger hash digests and longer
pathnames.
config [31mCONFIG_IMA_TEMPLATE[0m
bool "ima"
config [31mCONFIG_IMA_NG_TEMPLATE[0m
bool "ima-ng (default)"
config [31mCONFIG_IMA_SIG_TEMPLATE[0m
bool "ima-sig"
endchoice
config [31mCONFIG_IMA_DEFAULT_TEMPLATE[0m
string
depends on [31mCONFIG_IMA[0m
default "ima" if [31mCONFIG_IMA_TEMPLATE[0m
default "ima-ng" if [31mCONFIG_IMA_NG_TEMPLATE[0m
default "ima-sig" if [31mCONFIG_IMA_SIG_TEMPLATE[0m
choice
prompt "Default integrity hash algorithm"
default [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
depends on [31mCONFIG_IMA[0m
help
Select the default hash algorithm used for the measurement
list, integrity appraisal and audit log. The compiled default
hash algorithm can be overwritten using the kernel command
line 'ima_hash=' option.
config [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
bool "SHA1 (default)"
depends on [31mCONFIG_CRYPTO_SHA1[0m=y
config [31mCONFIG_IMA_DEFAULT_HASH_SHA256[0m
bool "SHA256"
depends on [31mCONFIG_CRYPTO_SHA256[0m=y && ![31mCONFIG_IMA_TEMPLATE[0m
config [31mCONFIG_IMA_DEFAULT_HASH_SHA512[0m
bool "SHA512"
depends on [31mCONFIG_CRYPTO_SHA512[0m=y && ![31mCONFIG_IMA_TEMPLATE[0m
config [31mCONFIG_IMA_DEFAULT_HASH_WP512[0m
bool "WP512"
depends on [31mCONFIG_CRYPTO_WP512[0m=y && ![31mCONFIG_IMA_TEMPLATE[0m
endchoice
config [31mCONFIG_IMA_DEFAULT_HASH[0m
string
depends on [31mCONFIG_IMA[0m
default "sha1" if [31mCONFIG_IMA_DEFAULT_HASH_SHA1[0m
default "sha256" if [31mCONFIG_IMA_DEFAULT_HASH_SHA256[0m
default "sha512" if [31mCONFIG_IMA_DEFAULT_HASH_SHA512[0m
default "wp512" if [31mCONFIG_IMA_DEFAULT_HASH_WP512[0m
config [31mCONFIG_IMA_WRITE_POLICY[0m
bool "Enable multiple writes to the IMA policy"
depends on [31mCONFIG_IMA[0m
default n
help
[31mCONFIG_IMA[0m policy can now be updated multiple times. The new rules get
appended to the original policy. Have in mind that the rules are
scanned in FIFO order so be careful when you design and add new ones.
If unsure, say N.
config [31mCONFIG_IMA_READ_POLICY[0m
bool "Enable reading back the current IMA policy"
depends on [31mCONFIG_IMA[0m
default y if [31mCONFIG_IMA_WRITE_POLICY[0m
default n if ![31mCONFIG_IMA_WRITE_POLICY[0m
help
It is often useful to be able to read back the [31mCONFIG_IMA[0m policy. It is
even more important after introducing CONFIG_IMA_WRITE_POLICY.
This option allows the root user to see the current policy rules.
config [31mCONFIG_IMA_APPRAISE[0m
bool "Appraise integrity measurements"
depends on [31mCONFIG_IMA[0m
default n
help
This option enables local measurement integrity appraisal.
It requires the system to be labeled with a security extended
attribute containing the file hash measurement. To protect
the security extended attributes from offline attack, enable
and configure [31mCONFIG_EVM[0m.
For more information on integrity appraisal refer to:
<http://linux-ima.sourceforge.net>
If unsure, say N.
config [31mCONFIG_IMA_ARCH_POLICY[0m
bool "Enable loading an IMA architecture specific policy"
depends on ([31mCONFIG_KEXEC_SIG[0m && [31mCONFIG_IMA[0m) || [31mCONFIG_IMA_APPRAISE[0m \
&& [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
default n
help
This option enables loading an [31mCONFIG_IMA[0m architecture specific policy
based on run time secure boot flags.
config [31mCONFIG_IMA_APPRAISE_BUILD_POLICY[0m
bool "IMA build time configured policy rules"
depends on [31mCONFIG_IMA_APPRAISE[0m && [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
default n
help
This option defines an [31mCONFIG_IMA[0m appraisal policy at build time, which
is enforced at run time without having to specify a builtin
policy name on the boot command line. The build time appraisal
policy rules persist after loading a custom policy.
Depending on the rules configured, this policy may require kernel
modules, firmware, the kexec kernel image, and/or the [31mCONFIG_IMA[0m policy
to be signed. Unsigned files might prevent the system from
booting or applications from working properly.
config [31mCONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS[0m
bool "Appraise firmware signatures"
depends on [31mCONFIG_IMA_APPRAISE_BUILD_POLICY[0m
default n
help
This option defines a policy requiring all firmware to be signed,
including the regulatory.db. If both this option and
[31mCONFIG_CFG80211_REQUIRE_SIGNED_REGDB[0m are enabled, then both signature
verification methods are necessary.
config [31mCONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS[0m
bool "Appraise kexec kernel image signatures"
depends on [31mCONFIG_IMA_APPRAISE_BUILD_POLICY[0m
default n
help
Enabling this rule will require all kexec'ed kernel images to
be signed and verified by a public key on the trusted [31mCONFIG_IMA[0m
keyring.
Kernel image signatures can not be verified by the original
kexec_load syscall. Enabling this rule will prevent its
usage.
config [31mCONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS[0m
bool "Appraise kernel modules signatures"
depends on [31mCONFIG_IMA_APPRAISE_BUILD_POLICY[0m
default n
help
Enabling this rule will require all kernel modules to be signed
and verified by a public key on the trusted [31mCONFIG_IMA[0m keyring.
Kernel module signatures can only be verified by [31mCONFIG_IMA[0m-appraisal,
via the finit_module syscall. Enabling this rule will prevent
the usage of the init_module syscall.
config [31mCONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS[0m
bool "Appraise IMA policy signature"
depends on [31mCONFIG_IMA_APPRAISE_BUILD_POLICY[0m
default n
help
Enabling this rule will require the [31mCONFIG_IMA[0m policy to be signed and
and verified by a key on the trusted [31mCONFIG_IMA[0m keyring.
config [31mCONFIG_IMA_APPRAISE_BOOTPARAM[0m
bool "ima_appraise boot parameter"
depends on [31mCONFIG_IMA_APPRAISE[0m && ![31mCONFIG_IMA_ARCH_POLICY[0m
default y
help
This option enables the different "ima_appraise=" modes
(eg. fix, log) from the boot command line.
config [31mCONFIG_IMA_APPRAISE_MODSIG[0m
bool "Support module-style signatures for appraisal"
depends on [31mCONFIG_IMA_APPRAISE[0m
depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
select [31mCONFIG_PKCS7_MESSAGE_PARSER[0m
select [31mCONFIG_MODULE_SIG_FORMAT[0m
default n
help
Adds support for signatures appended to files. The format of the
appended signature is the same used for signed kernel modules.
The modsig keyword can be used in the [31mCONFIG_IMA[0m policy to allow a hook
to accept such signatures.
config [31mCONFIG_IMA_TRUSTED_KEYRING[0m
bool "Require all keys on the .ima keyring be signed (deprecated)"
depends on [31mCONFIG_IMA_APPRAISE[0m && [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
select [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
default y
help
This option requires that all keys added to the .ima
keyring be signed by a key on the system trusted keyring.
This option is deprecated in favor of [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
config [31mCONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY[0m
bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)"
depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_SECONDARY_TRUSTED_KEYRING[0m
depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m
select [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m
default n
help
Keys may be added to the [31mCONFIG_IMA[0m or [31mCONFIG_IMA[0m blacklist keyrings, if the
key is validly signed by a CA cert in the system built-in or
secondary trusted keyrings.
Intermediate keys between those the kernel has compiled in and the
[31mCONFIG_IMA[0m keys to be added may be added to the system secondary keyring,
provided they are validly signed by a key already resident in the
built-in or secondary trusted keyrings.
config [31mCONFIG_IMA_BLACKLIST_KEYRING[0m
bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"
depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m
depends on [31mCONFIG_IMA_TRUSTED_KEYRING[0m
default n
help
This option creates an [31mCONFIG_IMA[0m blacklist keyring, which contains all
revoked [31mCONFIG_IMA[0m keys. It is consulted before any other keyring. If
the search is successful the requested operation is rejected and
an error is returned to the caller.
config [31mCONFIG_IMA_LOAD_X509[0m
bool "Load X509 certificate onto the '.ima' trusted keyring"
depends on [31mCONFIG_IMA_TRUSTED_KEYRING[0m
default n
help
File signature verification is based on the public keys
loaded on the .ima trusted keyring. These public keys are
X509 certificates signed by a trusted key on the
.system keyring. This option enables X509 certificate
loading from the kernel onto the '.ima' trusted keyring.
config [31mCONFIG_IMA_X509_PATH[0m
string "IMA X509 certificate path"
depends on [31mCONFIG_IMA_LOAD_X509[0m
default "/etc/keys/x509_ima.der"
help
This option defines [31mCONFIG_IMA[0m X509 certificate path.
config [31mCONFIG_IMA_APPRAISE_SIGNED_INIT[0m
bool "Require signed user-space initialization"
depends on [31mCONFIG_IMA_LOAD_X509[0m
default n
help
This option requires user-space init to be signed.