xref: /linux/fs/verity/Kconfig (revision 671e67b47e9fffd12c8f69eda853a202cb5b3fc5)
1*671e67b4SEric Biggers# SPDX-License-Identifier: GPL-2.0
2*671e67b4SEric Biggers
3*671e67b4SEric Biggersconfig FS_VERITY
4*671e67b4SEric Biggers	bool "FS Verity (read-only file-based authenticity protection)"
5*671e67b4SEric Biggers	select CRYPTO
6*671e67b4SEric Biggers	# SHA-256 is selected as it's intended to be the default hash algorithm.
7*671e67b4SEric Biggers	# To avoid bloat, other wanted algorithms must be selected explicitly.
8*671e67b4SEric Biggers	select CRYPTO_SHA256
9*671e67b4SEric Biggers	help
10*671e67b4SEric Biggers	  This option enables fs-verity.  fs-verity is the dm-verity
11*671e67b4SEric Biggers	  mechanism implemented at the file level.  On supported
12*671e67b4SEric Biggers	  filesystems (currently EXT4 and F2FS), userspace can use an
13*671e67b4SEric Biggers	  ioctl to enable verity for a file, which causes the filesystem
14*671e67b4SEric Biggers	  to build a Merkle tree for the file.  The filesystem will then
15*671e67b4SEric Biggers	  transparently verify any data read from the file against the
16*671e67b4SEric Biggers	  Merkle tree.  The file is also made read-only.
17*671e67b4SEric Biggers
18*671e67b4SEric Biggers	  This serves as an integrity check, but the availability of the
19*671e67b4SEric Biggers	  Merkle tree root hash also allows efficiently supporting
20*671e67b4SEric Biggers	  various use cases where normally the whole file would need to
21*671e67b4SEric Biggers	  be hashed at once, such as: (a) auditing (logging the file's
22*671e67b4SEric Biggers	  hash), or (b) authenticity verification (comparing the hash
23*671e67b4SEric Biggers	  against a known good value, e.g. from a digital signature).
24*671e67b4SEric Biggers
25*671e67b4SEric Biggers	  fs-verity is especially useful on large files where not all
26*671e67b4SEric Biggers	  the contents may actually be needed.  Also, fs-verity verifies
27*671e67b4SEric Biggers	  data each time it is paged back in, which provides better
28*671e67b4SEric Biggers	  protection against malicious disks vs. an ahead-of-time hash.
29*671e67b4SEric Biggers
30*671e67b4SEric Biggers	  If unsure, say N.
31*671e67b4SEric Biggers
32*671e67b4SEric Biggersconfig FS_VERITY_DEBUG
33*671e67b4SEric Biggers	bool "FS Verity debugging"
34*671e67b4SEric Biggers	depends on FS_VERITY
35*671e67b4SEric Biggers	help
36*671e67b4SEric Biggers	  Enable debugging messages related to fs-verity by default.
37*671e67b4SEric Biggers
38*671e67b4SEric Biggers	  Say N unless you are an fs-verity developer.
39