xref: /linux/certs/Kconfig (revision 0ea5c948cb64bab5bc7a5516774eb8536f05aa0d)
1# SPDX-License-Identifier: GPL-2.0
2menu "Certificates for signature checking"
3
4config MODULE_SIG_KEY
5	string "File name or PKCS#11 URI of module signing key"
6	default "certs/signing_key.pem"
7	depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES)
8	help
9         Provide the file name of a private key/certificate in PEM format,
10         or a PKCS#11 URI according to RFC7512. The file should contain, or
11         the URI should identify, both the certificate and its corresponding
12         private key.
13
14         If this option is unchanged from its default "certs/signing_key.pem",
15         then the kernel will automatically generate the private key and
16         certificate as described in Documentation/admin-guide/module-signing.rst
17
18choice
19	prompt "Type of module signing key to be generated"
20	depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES)
21	help
22	 The type of module signing key type to generate. This option
23	 does not apply if a #PKCS11 URI is used.
24
25config MODULE_SIG_KEY_TYPE_RSA
26	bool "RSA"
27	help
28	 Use an RSA key for module signing.
29
30config MODULE_SIG_KEY_TYPE_ECDSA
31	bool "ECDSA"
32	select CRYPTO_ECDSA
33	depends on !(MODULE_SIG_SHA256 || MODULE_SIG_SHA3_256)
34	help
35	 Use an elliptic curve key (NIST P384) for module signing. Use
36	 a strong hash of same or higher bit length, i.e. sha384 or
37	 sha512 for hashing modules.
38
39	 Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem,
40	 when falling back to building Linux 5.14 and older kernels.
41
42endchoice
43
44config SYSTEM_TRUSTED_KEYRING
45	bool "Provide system-wide ring of trusted keys"
46	depends on KEYS
47	depends on ASYMMETRIC_KEY_TYPE
48	depends on X509_CERTIFICATE_PARSER = y
49	help
50	  Provide a system keyring to which trusted keys can be added.  Keys in
51	  the keyring are considered to be trusted.  Keys may be added at will
52	  by the kernel from compiled-in data and from hardware key stores, but
53	  userspace may only add extra keys if those keys can be verified by
54	  keys already in the keyring.
55
56	  Keys in this keyring are used by module signature checking.
57
58config SYSTEM_TRUSTED_KEYS
59	string "Additional X.509 keys for default system keyring"
60	depends on SYSTEM_TRUSTED_KEYRING
61	help
62	  If set, this option should be the filename of a PEM-formatted file
63	  containing trusted X.509 certificates to be included in the default
64	  system keyring. Any certificate used for module signing is implicitly
65	  also trusted.
66
67	  NOTE: If you previously provided keys for the system keyring in the
68	  form of DER-encoded *.x509 files in the top-level build directory,
69	  those are no longer used. You will need to set this option instead.
70
71config SYSTEM_EXTRA_CERTIFICATE
72	bool "Reserve area for inserting a certificate without recompiling"
73	depends on SYSTEM_TRUSTED_KEYRING
74	help
75	  If set, space for an extra certificate will be reserved in the kernel
76	  image. This allows introducing a trusted certificate to the default
77	  system keyring without recompiling the kernel.
78
79config SYSTEM_EXTRA_CERTIFICATE_SIZE
80	int "Number of bytes to reserve for the extra certificate"
81	depends on SYSTEM_EXTRA_CERTIFICATE
82	default 4096
83	help
84	  This is the number of bytes reserved in the kernel image for a
85	  certificate to be inserted.
86
87config SECONDARY_TRUSTED_KEYRING
88	bool "Provide a keyring to which extra trustable keys may be added"
89	depends on SYSTEM_TRUSTED_KEYRING
90	help
91	  If set, provide a keyring to which extra keys may be added, provided
92	  those keys are not blacklisted and are vouched for by a key built
93	  into the kernel, machine keyring (if configured), or already in the
94	  secondary trusted keyring.
95
96config SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN
97	bool "Only allow additional certs signed by keys on the builtin trusted keyring"
98	depends on SECONDARY_TRUSTED_KEYRING
99	help
100	  If set, only certificates signed by keys on the builtin trusted
101	  keyring may be loaded onto the secondary trusted keyring.
102
103	  Note: The machine keyring, if configured, will be linked to the
104	  secondary keyring.  When enabling this option, it is recommended
105	  to also configure INTEGRITY_CA_MACHINE_KEYRING_MAX to prevent
106	  linking code signing keys with imputed trust to the secondary
107	  trusted keyring.
108
109config SYSTEM_BLACKLIST_KEYRING
110	bool "Provide system-wide ring of blacklisted keys"
111	depends on KEYS
112	help
113	  Provide a system keyring to which blacklisted keys can be added.
114	  Keys in the keyring are considered entirely untrusted.  Keys in this
115	  keyring are used by the module signature checking to reject loading
116	  of modules signed with a blacklisted key.
117
118config SYSTEM_BLACKLIST_HASH_LIST
119	string "Hashes to be preloaded into the system blacklist keyring"
120	depends on SYSTEM_BLACKLIST_KEYRING
121	help
122	  If set, this option should be the filename of a list of hashes in the
123	  form "<hash>", "<hash>", ... .  This will be included into a C
124	  wrapper to incorporate the list into the kernel.  Each <hash> must be a
125	  string starting with a prefix ("tbs" or "bin"), then a colon (":"), and
126	  finally an even number of hexadecimal lowercase characters (up to 128).
127	  Certificate hashes can be generated with
128	  tools/certs/print-cert-tbs-hash.sh .
129
130config SYSTEM_REVOCATION_LIST
131	bool "Provide system-wide ring of revocation certificates"
132	depends on SYSTEM_BLACKLIST_KEYRING
133	depends on PKCS7_MESSAGE_PARSER=y
134	help
135	  If set, this allows revocation certificates to be stored in the
136	  blacklist keyring and implements a hook whereby a PKCS#7 message can
137	  be checked to see if it matches such a certificate.
138
139config SYSTEM_REVOCATION_KEYS
140	string "X.509 certificates to be preloaded into the system blacklist keyring"
141	depends on SYSTEM_REVOCATION_LIST
142	help
143	  If set, this option should be the filename of a PEM-formatted file
144	  containing X.509 certificates to be included in the default blacklist
145	  keyring.
146
147config SYSTEM_BLACKLIST_AUTH_UPDATE
148	bool "Allow root to add signed blacklist keys"
149	depends on SYSTEM_BLACKLIST_KEYRING
150	depends on SYSTEM_DATA_VERIFICATION
151	help
152	  If set, provide the ability to load new blacklist keys at run time if
153	  they are signed and vouched by a certificate from the builtin trusted
154	  keyring.  The PKCS#7 signature of the description is set in the key
155	  payload.  Blacklist keys cannot be removed.
156
157endmenu
158