forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc 
 kernel/security/integrity/ima/Kconfig
....@@ -1,3 +1,4 @@
1
+# SPDX-License-Identifier: GPL-2.0-only
12 # IBM Integrity Measurement Architecture
23 #
34 config IMA
....@@ -7,7 +8,7 @@
78 	select CRYPTO_HMAC
89 	select CRYPTO_SHA1
910 	select CRYPTO_HASH_INFO
10
-	select TCG_TPM if HAS_IOMEM && !UML
11
+	select TCG_TPM if HAS_IOMEM
1112 	select TCG_TIS if TCG_TPM && X86
1213 	select TCG_CRB if TCG_TPM && ACPI
1314 	select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
....@@ -24,13 +25,15 @@
2425 	  an aggregate integrity value over this list inside the
2526 	  TPM hardware, so that the TPM can prove to a third party
2627 	  whether or not critical system files have been modified.
27
-	  Read <http://www.usenix.org/events/sec04/tech/sailer.html>
28
+	  Read <https://www.usenix.org/events/sec04/tech/sailer.html>
2829 	  to learn more about IMA.
2930 	  If unsure, say N.
3031 
32
+if IMA
33
+
3134 config IMA_KEXEC
3235 	bool "Enable carrying the IMA measurement list across a soft boot"
33
-	depends on IMA && TCG_TPM && HAVE_IMA_KEXEC
36
+	depends on TCG_TPM && HAVE_IMA_KEXEC
3437 	default n
3538 	help
3639 	   TPM PCRs are only reset on a hard reboot.  In order to validate
....@@ -42,7 +45,6 @@
4245 
4346 config IMA_MEASURE_PCR_IDX
4447 	int
45
-	depends on IMA
4648 	range 8 14
4749 	default 10
4850 	help
....@@ -52,7 +54,7 @@
5254 
5355 config IMA_LSM_RULES
5456 	bool
55
-	depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)
57
+	depends on AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR)
5658 	default y
5759 	help
5860 	  Disabling this option will disregard LSM based policy rules.
....@@ -60,7 +62,6 @@
6062 choice
6163 	prompt "Default template"
6264 	default IMA_NG_TEMPLATE
63
-	depends on IMA
6465 	help
6566 	  Select the default IMA measurement template.
6667 
....@@ -68,10 +69,9 @@
6869 	  hash, defined as 20 bytes, and a null terminated pathname,
6970 	  limited to 255 characters.  The 'ima-ng' measurement list
7071 	  template permits both larger hash digests and longer
71
-	  pathnames.
72
+	  pathnames. The configured default template can be replaced
73
+	  by specifying "ima_template=" on the boot command line.
7274 
73
-	config IMA_TEMPLATE
74
-		bool "ima"
7575 	config IMA_NG_TEMPLATE
7676 		bool "ima-ng (default)"
7777 	config IMA_SIG_TEMPLATE
....@@ -80,15 +80,12 @@
8080 
8181 config IMA_DEFAULT_TEMPLATE
8282 	string
83
-	depends on IMA
84
-	default "ima" if IMA_TEMPLATE
8583 	default "ima-ng" if IMA_NG_TEMPLATE
8684 	default "ima-sig" if IMA_SIG_TEMPLATE
8785 
8886 choice
8987 	prompt "Default integrity hash algorithm"
9088 	default IMA_DEFAULT_HASH_SHA1
91
-	depends on IMA
9289 	help
9390 	   Select the default hash algorithm used for the measurement
9491 	   list, integrity appraisal and audit log.  The compiled default
....@@ -101,28 +98,31 @@
10198 
10299 	config IMA_DEFAULT_HASH_SHA256
103100 		bool "SHA256"
104
-		depends on CRYPTO_SHA256=y && !IMA_TEMPLATE
101
+		depends on CRYPTO_SHA256=y
105102 
106103 	config IMA_DEFAULT_HASH_SHA512
107104 		bool "SHA512"
108
-		depends on CRYPTO_SHA512=y && !IMA_TEMPLATE
105
+		depends on CRYPTO_SHA512=y
109106 
110107 	config IMA_DEFAULT_HASH_WP512
111108 		bool "WP512"
112
-		depends on CRYPTO_WP512=y && !IMA_TEMPLATE
109
+		depends on CRYPTO_WP512=y
110
+
111
+	config IMA_DEFAULT_HASH_SM3
112
+		bool "SM3"
113
+		depends on CRYPTO_SM3=y
113114 endchoice
114115 
115116 config IMA_DEFAULT_HASH
116117 	string
117
-	depends on IMA
118118 	default "sha1" if IMA_DEFAULT_HASH_SHA1
119119 	default "sha256" if IMA_DEFAULT_HASH_SHA256
120120 	default "sha512" if IMA_DEFAULT_HASH_SHA512
121121 	default "wp512" if IMA_DEFAULT_HASH_WP512
122
+	default "sm3" if IMA_DEFAULT_HASH_SM3
122123 
123124 config IMA_WRITE_POLICY
124125 	bool "Enable multiple writes to the IMA policy"
125
-	depends on IMA
126126 	default n
127127 	help
128128 	  IMA policy can now be updated multiple times.  The new rules get
....@@ -133,7 +133,6 @@
133133 
134134 config IMA_READ_POLICY
135135 	bool "Enable reading back the current IMA policy"
136
-	depends on IMA
137136 	default y if IMA_WRITE_POLICY
138137 	default n if !IMA_WRITE_POLICY
139138 	help
....@@ -143,7 +142,6 @@
143142 
144143 config IMA_APPRAISE
145144 	bool "Appraise integrity measurements"
146
-	depends on IMA
147145 	default n
148146 	help
149147 	  This option enables local measurement integrity appraisal.
....@@ -155,6 +153,15 @@
155153 	  For more information on integrity appraisal refer to:
156154 	  <http://linux-ima.sourceforge.net>
157155 	  If unsure, say N.
156
+
157
+config IMA_ARCH_POLICY
158
+        bool "Enable loading an IMA architecture specific policy"
159
+        depends on (KEXEC_SIG && IMA) || IMA_APPRAISE \
160
+		   && INTEGRITY_ASYMMETRIC_KEYS
161
+        default n
162
+        help
163
+          This option enables loading an IMA architecture specific policy
164
+          based on run time secure boot flags.
158165 
159166 config IMA_APPRAISE_BUILD_POLICY
160167 	bool "IMA build time configured policy rules"
....@@ -222,17 +229,18 @@
222229 	  This option enables the different "ima_appraise=" modes
223230 	  (eg. fix, log) from the boot command line.
224231 
225
-config IMA_TRUSTED_KEYRING
226
-	bool "Require all keys on the .ima keyring be signed (deprecated)"
227
-	depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
232
+config IMA_APPRAISE_MODSIG
233
+	bool "Support module-style signatures for appraisal"
234
+	depends on IMA_APPRAISE
228235 	depends on INTEGRITY_ASYMMETRIC_KEYS
229
-	select INTEGRITY_TRUSTED_KEYRING
230
-	default y
236
+	select PKCS7_MESSAGE_PARSER
237
+	select MODULE_SIG_FORMAT
238
+	default n
231239 	help
232
-	   This option requires that all keys added to the .ima
233
-	   keyring be signed by a key on the system trusted keyring.
234
-
235
-	   This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING
240
+	   Adds support for signatures appended to files. The format of the
241
+	   appended signature is the same used for signed kernel modules.
242
+	   The modsig keyword can be used in the IMA policy to allow a hook
243
+	   to accept such signatures.
236244 
237245 config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
238246 	bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)"
....@@ -254,7 +262,7 @@
254262 config IMA_BLACKLIST_KEYRING
255263 	bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"
256264 	depends on SYSTEM_TRUSTED_KEYRING
257
-	depends on IMA_TRUSTED_KEYRING
265
+	depends on INTEGRITY_TRUSTED_KEYRING
258266 	default n
259267 	help
260268 	   This option creates an IMA blacklist keyring, which contains all
....@@ -264,7 +272,7 @@
264272 
265273 config IMA_LOAD_X509
266274 	bool "Load X509 certificate onto the '.ima' trusted keyring"
267
-	depends on IMA_TRUSTED_KEYRING
275
+	depends on INTEGRITY_TRUSTED_KEYRING
268276 	default n
269277 	help
270278 	   File signature verification is based on the public keys
....@@ -286,3 +294,23 @@
286294 	default n
287295 	help
288296 	   This option requires user-space init to be signed.
297
+
298
+config IMA_MEASURE_ASYMMETRIC_KEYS
299
+	bool
300
+	depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
301
+	default y
302
+
303
+config IMA_QUEUE_EARLY_BOOT_KEYS
304
+	bool
305
+	depends on IMA_MEASURE_ASYMMETRIC_KEYS
306
+	depends on SYSTEM_TRUSTED_KEYRING
307
+	default y
308
+
309
+config IMA_SECURE_AND_OR_TRUSTED_BOOT
310
+       bool
311
+       depends on IMA_ARCH_POLICY
312
+       help
313
+          This option is selected by architectures to enable secure and/or
314
+          trusted boot based on IMA runtime policies.
315
+
316
+endif