# SPDX-License-Identifier: GPL-2.0-only # config [31mCONFIG_INTEGRITY[0m bool "Integrity subsystem" depends on [31mCONFIG_SECURITY[0m default y help This option enables the integrity subsystem, which is comprised of a number of different components including the Integrity Measurement Architecture ([31mCONFIG_IMA[0m), Extended Verification Module ([31mCONFIG_EVM[0m), [31mCONFIG_IMA[0m-appraisal extension, digital signature verification extension and audit measurement log support. Each of these components can be enabled/disabled separately. Refer to the individual components for additional details. if [31mCONFIG_INTEGRITY[0m config [31mCONFIG_INTEGRITY_SIGNATURE[0m bool "Digital signature verification using multiple keyrings" default n select [31mCONFIG_KEYS[0m select [31mCONFIG_SIGNATURE[0m help This option enables digital signature verification support using multiple keyrings. It defines separate keyrings for each of the different use cases - evm, ima, and modules. Different keyrings improves search performance, but also allow to "lock" certain keyring to prevent adding new keys. This is useful for evm and module keyrings, when keys are usually only added from initramfs. config [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m bool "Enable asymmetric keys support" depends on [31mCONFIG_INTEGRITY_SIGNATURE[0m default n select [31mCONFIG_ASYMMETRIC_KEY_TYPE[0m select [31mCONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE[0m select [31mCONFIG_CRYPTO_RSA[0m select [31mCONFIG_X509_CERTIFICATE_PARSER[0m help This option enables digital signature verification using asymmetric keys. config [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m bool "Require all keys on the integrity keyrings be signed" depends on [31mCONFIG_SYSTEM_TRUSTED_KEYRING[0m depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m default y help This option requires that all keys added to the .ima and .evm keyrings be signed by a key on the system trusted keyring. config [31mCONFIG_INTEGRITY_PLATFORM_KEYRING[0m bool "Provide keyring for platform/firmware trusted keys" depends on [31mCONFIG_INTEGRITY_ASYMMETRIC_KEYS[0m depends on [31mCONFIG_SYSTEM_BLACKLIST_KEYRING[0m help Provide a separate, distinct keyring for platform trusted keys, which the kernel automatically populates during initialization from values provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. config [31mCONFIG_LOAD_UEFI_KEYS[0m depends on [31mCONFIG_INTEGRITY_PLATFORM_KEYRING[0m depends on [31mCONFIG_EFI[0m def_bool y config [31mCONFIG_LOAD_IPL_KEYS[0m depends on [31mCONFIG_INTEGRITY_PLATFORM_KEYRING[0m depends on [31mCONFIG_S390[0m def_bool y config [31mCONFIG_INTEGRITY_AUDIT[0m bool "Enables integrity auditing support " depends on [31mCONFIG_AUDIT[0m default y help In addition to enabling integrity auditing support, this option adds a kernel parameter 'integrity_audit', which controls the level of integrity auditing messages. 0 - basic integrity auditing messages (default) 1 - additional integrity auditing messages Additional informational integrity auditing messages would be enabled by specifying 'integrity_audit=1' on the kernel command line. source "security/integrity/ima/Kconfig" source "security/integrity/evm/Kconfig" endif # if [31mCONFIG_INTEGRITY[0m |