1*671e67b4SEric Biggers# SPDX-License-Identifier: GPL-2.0 2*671e67b4SEric Biggers 3*671e67b4SEric Biggersconfig FS_VERITY 4*671e67b4SEric Biggers bool "FS Verity (read-only file-based authenticity protection)" 5*671e67b4SEric Biggers select CRYPTO 6*671e67b4SEric Biggers # SHA-256 is selected as it's intended to be the default hash algorithm. 7*671e67b4SEric Biggers # To avoid bloat, other wanted algorithms must be selected explicitly. 8*671e67b4SEric Biggers select CRYPTO_SHA256 9*671e67b4SEric Biggers help 10*671e67b4SEric Biggers This option enables fs-verity. fs-verity is the dm-verity 11*671e67b4SEric Biggers mechanism implemented at the file level. On supported 12*671e67b4SEric Biggers filesystems (currently EXT4 and F2FS), userspace can use an 13*671e67b4SEric Biggers ioctl to enable verity for a file, which causes the filesystem 14*671e67b4SEric Biggers to build a Merkle tree for the file. The filesystem will then 15*671e67b4SEric Biggers transparently verify any data read from the file against the 16*671e67b4SEric Biggers Merkle tree. The file is also made read-only. 17*671e67b4SEric Biggers 18*671e67b4SEric Biggers This serves as an integrity check, but the availability of the 19*671e67b4SEric Biggers Merkle tree root hash also allows efficiently supporting 20*671e67b4SEric Biggers various use cases where normally the whole file would need to 21*671e67b4SEric Biggers be hashed at once, such as: (a) auditing (logging the file's 22*671e67b4SEric Biggers hash), or (b) authenticity verification (comparing the hash 23*671e67b4SEric Biggers against a known good value, e.g. from a digital signature). 24*671e67b4SEric Biggers 25*671e67b4SEric Biggers fs-verity is especially useful on large files where not all 26*671e67b4SEric Biggers the contents may actually be needed. Also, fs-verity verifies 27*671e67b4SEric Biggers data each time it is paged back in, which provides better 28*671e67b4SEric Biggers protection against malicious disks vs. an ahead-of-time hash. 29*671e67b4SEric Biggers 30*671e67b4SEric Biggers If unsure, say N. 31*671e67b4SEric Biggers 32*671e67b4SEric Biggersconfig FS_VERITY_DEBUG 33*671e67b4SEric Biggers bool "FS Verity debugging" 34*671e67b4SEric Biggers depends on FS_VERITY 35*671e67b4SEric Biggers help 36*671e67b4SEric Biggers Enable debugging messages related to fs-verity by default. 37*671e67b4SEric Biggers 38*671e67b4SEric Biggers Say N unless you are an fs-verity developer. 39