# SPDX-License-Identifier: GPL-2.0-only config [31mCONFIG_EVM[0m bool "EVM support" select [31mCONFIG_KEYS[0m select [31mCONFIG_ENCRYPTED_KEYS[0m select [31mCONFIG_CRYPTO_HMAC[0m select [31mCONFIG_CRYPTO_SHA1[0m select [31mCONFIG_CRYPTO_HASH_INFO[0m default n help [31mCONFIG_EVM[0m protects a file's security extended attributes against integrity attacks. If you are unsure how to answer this question, answer N. config [31mCONFIG_EVM_ATTR_FSUUID[0m bool "FSUUID (version 2)" default y depends on [31mCONFIG_EVM[0m help Include filesystem UUID for HMAC calculation. Default value is 'selected', which is former version 2. if 'not selected', it is former version 1 WARNING: changing the HMAC calculation method or adding additional info to the calculation, requires existing [31mCONFIG_EVM[0m labeled file systems to be relabeled. config [31mCONFIG_EVM_EXTRA_SMACK_XATTRS[0m bool "Additional SMACK xattrs" depends on [31mCONFIG_EVM[0m && [31mCONFIG_SECURITY_SMACK[0m default n help Include additional SMACK xattrs for HMAC calculation. In addition to the original security xattrs (eg. security.selinux, security.SMACK64, security.capability, and security.ima) included in the HMAC calculation, enabling this option includes newly defined Smack xattrs: security.SMACK64EXEC, security.SMACK64TRANSMUTE and security.SMACK64MMAP. WARNING: changing the HMAC calculation method or adding additional info to the calculation, requires existing [31mCONFIG_EVM[0m labeled file systems to be relabeled. config [31mCONFIG_EVM_ADD_XATTRS[0m bool "Add additional EVM extended attributes at runtime" depends on [31mCONFIG_EVM[0m default n help Allow userland to provide additional xattrs for HMAC calculation. When this option is enabled, root can add additional xattrs to the list used by [31mCONFIG_EVM[0m by writing them into /sys/kernel/security/integrity/evm/evm_xattrs. config [31mCONFIG_EVM_LOAD_X509[0m bool "Load an X509 certificate onto the '.evm' trusted keyring" depends on [31mCONFIG_EVM[0m && [31mCONFIG_INTEGRITY_TRUSTED_KEYRING[0m default n help Load an X509 certificate onto the '.evm' trusted keyring. This option enables X509 certificate loading from the kernel onto the '.evm' trusted keyring. [31mCONFIG_A[0m public key can be used to verify [31mCONFIG_EVM[0m integrity starting from the 'init' process. config [31mCONFIG_EVM_X509_PATH[0m string "EVM X509 certificate path" depends on [31mCONFIG_EVM_LOAD_X509[0m default "/etc/keys/x509_evm.der" help This option defines X509 certificate path. |