1*cfc411e7SDavid Howellsmenu "Certificates for signature checking" 2*cfc411e7SDavid Howells 3*cfc411e7SDavid Howellsconfig MODULE_SIG_KEY 4*cfc411e7SDavid Howells string "File name or PKCS#11 URI of module signing key" 5*cfc411e7SDavid Howells default "certs/signing_key.pem" 6*cfc411e7SDavid Howells depends on MODULE_SIG 7*cfc411e7SDavid Howells help 8*cfc411e7SDavid Howells Provide the file name of a private key/certificate in PEM format, 9*cfc411e7SDavid Howells or a PKCS#11 URI according to RFC7512. The file should contain, or 10*cfc411e7SDavid Howells the URI should identify, both the certificate and its corresponding 11*cfc411e7SDavid Howells private key. 12*cfc411e7SDavid Howells 13*cfc411e7SDavid Howells If this option is unchanged from its default "certs/signing_key.pem", 14*cfc411e7SDavid Howells then the kernel will automatically generate the private key and 15*cfc411e7SDavid Howells certificate as described in Documentation/module-signing.txt 16*cfc411e7SDavid Howells 17*cfc411e7SDavid Howellsconfig SYSTEM_TRUSTED_KEYRING 18*cfc411e7SDavid Howells bool "Provide system-wide ring of trusted keys" 19*cfc411e7SDavid Howells depends on KEYS 20*cfc411e7SDavid Howells help 21*cfc411e7SDavid Howells Provide a system keyring to which trusted keys can be added. Keys in 22*cfc411e7SDavid Howells the keyring are considered to be trusted. Keys may be added at will 23*cfc411e7SDavid Howells by the kernel from compiled-in data and from hardware key stores, but 24*cfc411e7SDavid Howells userspace may only add extra keys if those keys can be verified by 25*cfc411e7SDavid Howells keys already in the keyring. 26*cfc411e7SDavid Howells 27*cfc411e7SDavid Howells Keys in this keyring are used by module signature checking. 28*cfc411e7SDavid Howells 29*cfc411e7SDavid Howellsconfig SYSTEM_TRUSTED_KEYS 30*cfc411e7SDavid Howells string "Additional X.509 keys for default system keyring" 31*cfc411e7SDavid Howells depends on SYSTEM_TRUSTED_KEYRING 32*cfc411e7SDavid Howells help 33*cfc411e7SDavid Howells If set, this option should be the filename of a PEM-formatted file 34*cfc411e7SDavid Howells containing trusted X.509 certificates to be included in the default 35*cfc411e7SDavid Howells system keyring. Any certificate used for module signing is implicitly 36*cfc411e7SDavid Howells also trusted. 37*cfc411e7SDavid Howells 38*cfc411e7SDavid Howells NOTE: If you previously provided keys for the system keyring in the 39*cfc411e7SDavid Howells form of DER-encoded *.x509 files in the top-level build directory, 40*cfc411e7SDavid Howells those are no longer used. You will need to set this option instead. 41*cfc411e7SDavid Howells 42*cfc411e7SDavid Howellsendmenu 43