forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-11 6778948f9de86c3cfaf36725a7c87dcff9ba247f 
 kernel/security/integrity/ima/Kconfig
....@@ -1,3 +1,4 @@
1
+# SPDX-License-Identifier: GPL-2.0-only
12 # IBM Integrity Measurement Architecture
23 #
34 config IMA
....@@ -24,7 +25,7 @@
2425 	  an aggregate integrity value over this list inside the
2526 	  TPM hardware, so that the TPM can prove to a third party
2627 	  whether or not critical system files have been modified.
27
-	  Read <http://www.usenix.org/events/sec04/tech/sailer.html>
28
+	  Read <https://www.usenix.org/events/sec04/tech/sailer.html>
2829 	  to learn more about IMA.
2930 	  If unsure, say N.
3031 
....@@ -52,7 +53,7 @@
5253 
5354 config IMA_LSM_RULES
5455 	bool
55
-	depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)
56
+	depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR)
5657 	default y
5758 	help
5859 	  Disabling this option will disregard LSM based policy rules.
....@@ -68,10 +69,9 @@
6869 	  hash, defined as 20 bytes, and a null terminated pathname,
6970 	  limited to 255 characters.  The 'ima-ng' measurement list
7071 	  template permits both larger hash digests and longer
71
-	  pathnames.
72
+	  pathnames. The configured default template can be replaced
73
+	  by specifying "ima_template=" on the boot command line.
7274 
73
-	config IMA_TEMPLATE
74
-		bool "ima"
7575 	config IMA_NG_TEMPLATE
7676 		bool "ima-ng (default)"
7777 	config IMA_SIG_TEMPLATE
....@@ -81,7 +81,6 @@
8181 config IMA_DEFAULT_TEMPLATE
8282 	string
8383 	depends on IMA
84
-	default "ima" if IMA_TEMPLATE
8584 	default "ima-ng" if IMA_NG_TEMPLATE
8685 	default "ima-sig" if IMA_SIG_TEMPLATE
8786 
....@@ -101,15 +100,19 @@
101100 
102101 	config IMA_DEFAULT_HASH_SHA256
103102 		bool "SHA256"
104
-		depends on CRYPTO_SHA256=y && !IMA_TEMPLATE
103
+		depends on CRYPTO_SHA256=y
105104 
106105 	config IMA_DEFAULT_HASH_SHA512
107106 		bool "SHA512"
108
-		depends on CRYPTO_SHA512=y && !IMA_TEMPLATE
107
+		depends on CRYPTO_SHA512=y
109108 
110109 	config IMA_DEFAULT_HASH_WP512
111110 		bool "WP512"
112
-		depends on CRYPTO_WP512=y && !IMA_TEMPLATE
111
+		depends on CRYPTO_WP512=y
112
+
113
+	config IMA_DEFAULT_HASH_SM3
114
+		bool "SM3"
115
+		depends on CRYPTO_SM3=y
113116 endchoice
114117 
115118 config IMA_DEFAULT_HASH
....@@ -119,6 +122,7 @@
119122 	default "sha256" if IMA_DEFAULT_HASH_SHA256
120123 	default "sha512" if IMA_DEFAULT_HASH_SHA512
121124 	default "wp512" if IMA_DEFAULT_HASH_WP512
125
+	default "sm3" if IMA_DEFAULT_HASH_SM3
122126 
123127 config IMA_WRITE_POLICY
124128 	bool "Enable multiple writes to the IMA policy"
....@@ -155,6 +159,15 @@
155159 	  For more information on integrity appraisal refer to:
156160 	  <http://linux-ima.sourceforge.net>
157161 	  If unsure, say N.
162
+
163
+config IMA_ARCH_POLICY
164
+        bool "Enable loading an IMA architecture specific policy"
165
+        depends on (KEXEC_SIG && IMA) || IMA_APPRAISE \
166
+		   && INTEGRITY_ASYMMETRIC_KEYS
167
+        default n
168
+        help
169
+          This option enables loading an IMA architecture specific policy
170
+          based on run time secure boot flags.
158171 
159172 config IMA_APPRAISE_BUILD_POLICY
160173 	bool "IMA build time configured policy rules"
....@@ -222,6 +235,19 @@
222235 	  This option enables the different "ima_appraise=" modes
223236 	  (eg. fix, log) from the boot command line.
224237 
238
+config IMA_APPRAISE_MODSIG
239
+	bool "Support module-style signatures for appraisal"
240
+	depends on IMA_APPRAISE
241
+	depends on INTEGRITY_ASYMMETRIC_KEYS
242
+	select PKCS7_MESSAGE_PARSER
243
+	select MODULE_SIG_FORMAT
244
+	default n
245
+	help
246
+	   Adds support for signatures appended to files. The format of the
247
+	   appended signature is the same used for signed kernel modules.
248
+	   The modsig keyword can be used in the IMA policy to allow a hook
249
+	   to accept such signatures.
250
+
225251 config IMA_TRUSTED_KEYRING
226252 	bool "Require all keys on the .ima keyring be signed (deprecated)"
227253 	depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
....@@ -286,3 +312,22 @@
286312 	default n
287313 	help
288314 	   This option requires user-space init to be signed.
315
+
316
+config IMA_MEASURE_ASYMMETRIC_KEYS
317
+	bool
318
+	depends on IMA
319
+	depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
320
+	default y
321
+
322
+config IMA_QUEUE_EARLY_BOOT_KEYS
323
+	bool
324
+	depends on IMA_MEASURE_ASYMMETRIC_KEYS
325
+	depends on SYSTEM_TRUSTED_KEYRING
326
+	default y
327
+
328
+config IMA_SECURE_AND_OR_TRUSTED_BOOT
329
+       bool
330
+       depends on IMA_ARCH_POLICY
331
+       help
332
+          This option is selected by architectures to enable secure and/or
333
+          trusted boot based on IMA runtime policies.