13323eec9SMimi Zohar# IBM Integrity Measurement Architecture 23323eec9SMimi Zohar# 33323eec9SMimi Zoharconfig IMA 43323eec9SMimi Zohar bool "Integrity Measurement Architecture(IMA)" 53323eec9SMimi Zohar select SECURITYFS 63323eec9SMimi Zohar select CRYPTO 73323eec9SMimi Zohar select CRYPTO_HMAC 83323eec9SMimi Zohar select CRYPTO_MD5 93323eec9SMimi Zohar select CRYPTO_SHA1 10c7c8bb23SDmitry Kasatkin select CRYPTO_HASH_INFO 11f4a0391dSFabio Estevam select TCG_TPM if HAS_IOMEM && !UML 12a69f1589SRandy Dunlap select TCG_TIS if TCG_TPM && X86 13fac37c62SJiandi An select TCG_CRB if TCG_TPM && ACPI 1463a0eb78SMichael Ellerman select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES 15*2afd020aSStefan Berger select INTEGRITY_AUDIT if AUDIT 163323eec9SMimi Zohar help 173323eec9SMimi Zohar The Trusted Computing Group(TCG) runtime Integrity 183323eec9SMimi Zohar Measurement Architecture(IMA) maintains a list of hash 193323eec9SMimi Zohar values of executables and other sensitive system files, 203323eec9SMimi Zohar as they are read or executed. If an attacker manages 213323eec9SMimi Zohar to change the contents of an important system file 223323eec9SMimi Zohar being measured, we can tell. 233323eec9SMimi Zohar 243323eec9SMimi Zohar If your system has a TPM chip, then IMA also maintains 253323eec9SMimi Zohar an aggregate integrity value over this list inside the 263323eec9SMimi Zohar TPM hardware, so that the TPM can prove to a third party 273323eec9SMimi Zohar whether or not critical system files have been modified. 283323eec9SMimi Zohar Read <http://www.usenix.org/events/sec04/tech/sailer.html> 293323eec9SMimi Zohar to learn more about IMA. 303323eec9SMimi Zohar If unsure, say N. 313323eec9SMimi Zohar 32d158847aSMimi Zoharconfig IMA_KEXEC 33d158847aSMimi Zohar bool "Enable carrying the IMA measurement list across a soft boot" 34d158847aSMimi Zohar depends on IMA && TCG_TPM && HAVE_IMA_KEXEC 35d158847aSMimi Zohar default n 36d158847aSMimi Zohar help 37d158847aSMimi Zohar TPM PCRs are only reset on a hard reboot. In order to validate 38d158847aSMimi Zohar a TPM's quote after a soft boot, the IMA measurement list of the 39d158847aSMimi Zohar running kernel must be saved and restored on boot. 40d158847aSMimi Zohar 41d158847aSMimi Zohar Depending on the IMA policy, the measurement list can grow to 42d158847aSMimi Zohar be very large. 43d158847aSMimi Zohar 443323eec9SMimi Zoharconfig IMA_MEASURE_PCR_IDX 453323eec9SMimi Zohar int 463323eec9SMimi Zohar depends on IMA 473323eec9SMimi Zohar range 8 14 483323eec9SMimi Zohar default 10 493323eec9SMimi Zohar help 503323eec9SMimi Zohar IMA_MEASURE_PCR_IDX determines the TPM PCR register index 513323eec9SMimi Zohar that IMA uses to maintain the integrity aggregate of the 523323eec9SMimi Zohar measurement list. If unsure, use the default 10. 533323eec9SMimi Zohar 544af4662fSMimi Zoharconfig IMA_LSM_RULES 554af4662fSMimi Zohar bool 56b53fab9dSRandy Dunlap depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK) 574af4662fSMimi Zohar default y 584af4662fSMimi Zohar help 59b53fab9dSRandy Dunlap Disabling this option will disregard LSM based policy rules. 602fe5d6deSMimi Zohar 614286587dSMimi Zoharchoice 624286587dSMimi Zohar prompt "Default template" 634286587dSMimi Zohar default IMA_NG_TEMPLATE 644286587dSMimi Zohar depends on IMA 654286587dSMimi Zohar help 664286587dSMimi Zohar Select the default IMA measurement template. 674286587dSMimi Zohar 684286587dSMimi Zohar The original 'ima' measurement list template contains a 694286587dSMimi Zohar hash, defined as 20 bytes, and a null terminated pathname, 704286587dSMimi Zohar limited to 255 characters. The 'ima-ng' measurement list 714286587dSMimi Zohar template permits both larger hash digests and longer 724286587dSMimi Zohar pathnames. 734286587dSMimi Zohar 744286587dSMimi Zohar config IMA_TEMPLATE 754286587dSMimi Zohar bool "ima" 764286587dSMimi Zohar config IMA_NG_TEMPLATE 774286587dSMimi Zohar bool "ima-ng (default)" 78bcbc9b0cSMimi Zohar config IMA_SIG_TEMPLATE 79bcbc9b0cSMimi Zohar bool "ima-sig" 804286587dSMimi Zoharendchoice 814286587dSMimi Zohar 824286587dSMimi Zoharconfig IMA_DEFAULT_TEMPLATE 834286587dSMimi Zohar string 844286587dSMimi Zohar depends on IMA 854286587dSMimi Zohar default "ima" if IMA_TEMPLATE 864286587dSMimi Zohar default "ima-ng" if IMA_NG_TEMPLATE 87bcbc9b0cSMimi Zohar default "ima-sig" if IMA_SIG_TEMPLATE 884286587dSMimi Zohar 89e7a2ad7eSMimi Zoharchoice 90e7a2ad7eSMimi Zohar prompt "Default integrity hash algorithm" 91e7a2ad7eSMimi Zohar default IMA_DEFAULT_HASH_SHA1 92e7a2ad7eSMimi Zohar depends on IMA 93e7a2ad7eSMimi Zohar help 94e7a2ad7eSMimi Zohar Select the default hash algorithm used for the measurement 95e7a2ad7eSMimi Zohar list, integrity appraisal and audit log. The compiled default 96e7a2ad7eSMimi Zohar hash algorithm can be overwritten using the kernel command 97e7a2ad7eSMimi Zohar line 'ima_hash=' option. 98e7a2ad7eSMimi Zohar 99e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA1 100e7a2ad7eSMimi Zohar bool "SHA1 (default)" 10138d19268SBen Hutchings depends on CRYPTO_SHA1=y 102e7a2ad7eSMimi Zohar 103e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA256 104e7a2ad7eSMimi Zohar bool "SHA256" 10538d19268SBen Hutchings depends on CRYPTO_SHA256=y && !IMA_TEMPLATE 106e7a2ad7eSMimi Zohar 107e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA512 108e7a2ad7eSMimi Zohar bool "SHA512" 10938d19268SBen Hutchings depends on CRYPTO_SHA512=y && !IMA_TEMPLATE 110e7a2ad7eSMimi Zohar 111e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_WP512 112e7a2ad7eSMimi Zohar bool "WP512" 11338d19268SBen Hutchings depends on CRYPTO_WP512=y && !IMA_TEMPLATE 114e7a2ad7eSMimi Zoharendchoice 115e7a2ad7eSMimi Zohar 116e7a2ad7eSMimi Zoharconfig IMA_DEFAULT_HASH 117e7a2ad7eSMimi Zohar string 118e7a2ad7eSMimi Zohar depends on IMA 119e7a2ad7eSMimi Zohar default "sha1" if IMA_DEFAULT_HASH_SHA1 120e7a2ad7eSMimi Zohar default "sha256" if IMA_DEFAULT_HASH_SHA256 121e7a2ad7eSMimi Zohar default "sha512" if IMA_DEFAULT_HASH_SHA512 122e7a2ad7eSMimi Zohar default "wp512" if IMA_DEFAULT_HASH_WP512 123e7a2ad7eSMimi Zohar 12438d859f9SPetko Manolovconfig IMA_WRITE_POLICY 12538d859f9SPetko Manolov bool "Enable multiple writes to the IMA policy" 12638d859f9SPetko Manolov depends on IMA 12738d859f9SPetko Manolov default n 12838d859f9SPetko Manolov help 12938d859f9SPetko Manolov IMA policy can now be updated multiple times. The new rules get 13038d859f9SPetko Manolov appended to the original policy. Have in mind that the rules are 13138d859f9SPetko Manolov scanned in FIFO order so be careful when you design and add new ones. 13238d859f9SPetko Manolov 13338d859f9SPetko Manolov If unsure, say N. 13438d859f9SPetko Manolov 13580eae209SPetko Manolovconfig IMA_READ_POLICY 13680eae209SPetko Manolov bool "Enable reading back the current IMA policy" 13780eae209SPetko Manolov depends on IMA 13880eae209SPetko Manolov default y if IMA_WRITE_POLICY 13980eae209SPetko Manolov default n if !IMA_WRITE_POLICY 14080eae209SPetko Manolov help 14180eae209SPetko Manolov It is often useful to be able to read back the IMA policy. It is 14280eae209SPetko Manolov even more important after introducing CONFIG_IMA_WRITE_POLICY. 14380eae209SPetko Manolov This option allows the root user to see the current policy rules. 14480eae209SPetko Manolov 1452fe5d6deSMimi Zoharconfig IMA_APPRAISE 1462fe5d6deSMimi Zohar bool "Appraise integrity measurements" 1472fe5d6deSMimi Zohar depends on IMA 1482fe5d6deSMimi Zohar default n 1492fe5d6deSMimi Zohar help 1502fe5d6deSMimi Zohar This option enables local measurement integrity appraisal. 1512fe5d6deSMimi Zohar It requires the system to be labeled with a security extended 1522fe5d6deSMimi Zohar attribute containing the file hash measurement. To protect 1532fe5d6deSMimi Zohar the security extended attributes from offline attack, enable 1542fe5d6deSMimi Zohar and configure EVM. 1552fe5d6deSMimi Zohar 1562fe5d6deSMimi Zohar For more information on integrity appraisal refer to: 1572fe5d6deSMimi Zohar <http://linux-ima.sourceforge.net> 1582fe5d6deSMimi Zohar If unsure, say N. 1597d2ce232SMimi Zohar 160ef96837bSMimi Zoharconfig IMA_APPRAISE_BUILD_POLICY 161ef96837bSMimi Zohar bool "IMA build time configured policy rules" 162ef96837bSMimi Zohar depends on IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS 163ef96837bSMimi Zohar default n 164ef96837bSMimi Zohar help 165ef96837bSMimi Zohar This option defines an IMA appraisal policy at build time, which 166ef96837bSMimi Zohar is enforced at run time without having to specify a builtin 167ef96837bSMimi Zohar policy name on the boot command line. The build time appraisal 168ef96837bSMimi Zohar policy rules persist after loading a custom policy. 169ef96837bSMimi Zohar 170ef96837bSMimi Zohar Depending on the rules configured, this policy may require kernel 171ef96837bSMimi Zohar modules, firmware, the kexec kernel image, and/or the IMA policy 172ef96837bSMimi Zohar to be signed. Unsigned files might prevent the system from 173ef96837bSMimi Zohar booting or applications from working properly. 174ef96837bSMimi Zohar 175ef96837bSMimi Zoharconfig IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS 176ef96837bSMimi Zohar bool "Appraise firmware signatures" 177ef96837bSMimi Zohar depends on IMA_APPRAISE_BUILD_POLICY 178ef96837bSMimi Zohar default n 179ef96837bSMimi Zohar help 180ef96837bSMimi Zohar This option defines a policy requiring all firmware to be signed, 181ef96837bSMimi Zohar including the regulatory.db. If both this option and 182ef96837bSMimi Zohar CFG80211_REQUIRE_SIGNED_REGDB are enabled, then both signature 183ef96837bSMimi Zohar verification methods are necessary. 184ef96837bSMimi Zohar 185ef96837bSMimi Zoharconfig IMA_APPRAISE_REQUIRE_KEXEC_SIGS 186ef96837bSMimi Zohar bool "Appraise kexec kernel image signatures" 187ef96837bSMimi Zohar depends on IMA_APPRAISE_BUILD_POLICY 188ef96837bSMimi Zohar default n 189ef96837bSMimi Zohar help 190ef96837bSMimi Zohar Enabling this rule will require all kexec'ed kernel images to 191ef96837bSMimi Zohar be signed and verified by a public key on the trusted IMA 192ef96837bSMimi Zohar keyring. 193ef96837bSMimi Zohar 194ef96837bSMimi Zohar Kernel image signatures can not be verified by the original 195ef96837bSMimi Zohar kexec_load syscall. Enabling this rule will prevent its 196ef96837bSMimi Zohar usage. 197ef96837bSMimi Zohar 198ef96837bSMimi Zoharconfig IMA_APPRAISE_REQUIRE_MODULE_SIGS 199ef96837bSMimi Zohar bool "Appraise kernel modules signatures" 200ef96837bSMimi Zohar depends on IMA_APPRAISE_BUILD_POLICY 201ef96837bSMimi Zohar default n 202ef96837bSMimi Zohar help 203ef96837bSMimi Zohar Enabling this rule will require all kernel modules to be signed 204ef96837bSMimi Zohar and verified by a public key on the trusted IMA keyring. 205ef96837bSMimi Zohar 206ef96837bSMimi Zohar Kernel module signatures can only be verified by IMA-appraisal, 207ef96837bSMimi Zohar via the finit_module syscall. Enabling this rule will prevent 208ef96837bSMimi Zohar the usage of the init_module syscall. 209ef96837bSMimi Zohar 210ef96837bSMimi Zoharconfig IMA_APPRAISE_REQUIRE_POLICY_SIGS 211ef96837bSMimi Zohar bool "Appraise IMA policy signature" 212ef96837bSMimi Zohar depends on IMA_APPRAISE_BUILD_POLICY 213ef96837bSMimi Zohar default n 214ef96837bSMimi Zohar help 215ef96837bSMimi Zohar Enabling this rule will require the IMA policy to be signed and 216ef96837bSMimi Zohar and verified by a key on the trusted IMA keyring. 217ef96837bSMimi Zohar 218e1f5e01fSMimi Zoharconfig IMA_APPRAISE_BOOTPARAM 219e1f5e01fSMimi Zohar bool "ima_appraise boot parameter" 220e1f5e01fSMimi Zohar depends on IMA_APPRAISE 221e1f5e01fSMimi Zohar default y 222e1f5e01fSMimi Zohar help 223e1f5e01fSMimi Zohar This option enables the different "ima_appraise=" modes 224e1f5e01fSMimi Zohar (eg. fix, log) from the boot command line. 225e1f5e01fSMimi Zohar 2267d2ce232SMimi Zoharconfig IMA_TRUSTED_KEYRING 227f4dc3778SDmitry Kasatkin bool "Require all keys on the .ima keyring be signed (deprecated)" 2287d2ce232SMimi Zohar depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING 2297d2ce232SMimi Zohar depends on INTEGRITY_ASYMMETRIC_KEYS 230f4dc3778SDmitry Kasatkin select INTEGRITY_TRUSTED_KEYRING 2317d2ce232SMimi Zohar default y 2327d2ce232SMimi Zohar help 2337d2ce232SMimi Zohar This option requires that all keys added to the .ima 2347d2ce232SMimi Zohar keyring be signed by a key on the system trusted keyring. 235fd5f4e90SDmitry Kasatkin 236f4dc3778SDmitry Kasatkin This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING 237f4dc3778SDmitry Kasatkin 23856104cf2SDavid Howellsconfig IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY 23956104cf2SDavid Howells bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" 24056104cf2SDavid Howells depends on SYSTEM_TRUSTED_KEYRING 24156104cf2SDavid Howells depends on SECONDARY_TRUSTED_KEYRING 24256104cf2SDavid Howells depends on INTEGRITY_ASYMMETRIC_KEYS 24356104cf2SDavid Howells select INTEGRITY_TRUSTED_KEYRING 24456104cf2SDavid Howells default n 24556104cf2SDavid Howells help 24656104cf2SDavid Howells Keys may be added to the IMA or IMA blacklist keyrings, if the 24756104cf2SDavid Howells key is validly signed by a CA cert in the system built-in or 24856104cf2SDavid Howells secondary trusted keyrings. 24956104cf2SDavid Howells 25056104cf2SDavid Howells Intermediate keys between those the kernel has compiled in and the 25156104cf2SDavid Howells IMA keys to be added may be added to the system secondary keyring, 25256104cf2SDavid Howells provided they are validly signed by a key already resident in the 25356104cf2SDavid Howells built-in or secondary trusted keyrings. 25456104cf2SDavid Howells 25556104cf2SDavid Howellsconfig IMA_BLACKLIST_KEYRING 25656104cf2SDavid Howells bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" 25741c89b64SPetko Manolov depends on SYSTEM_TRUSTED_KEYRING 25841c89b64SPetko Manolov depends on IMA_TRUSTED_KEYRING 25941c89b64SPetko Manolov default n 26041c89b64SPetko Manolov help 26156104cf2SDavid Howells This option creates an IMA blacklist keyring, which contains all 26256104cf2SDavid Howells revoked IMA keys. It is consulted before any other keyring. If 26356104cf2SDavid Howells the search is successful the requested operation is rejected and 26456104cf2SDavid Howells an error is returned to the caller. 26541c89b64SPetko Manolov 266fd5f4e90SDmitry Kasatkinconfig IMA_LOAD_X509 267fd5f4e90SDmitry Kasatkin bool "Load X509 certificate onto the '.ima' trusted keyring" 268fd5f4e90SDmitry Kasatkin depends on IMA_TRUSTED_KEYRING 269fd5f4e90SDmitry Kasatkin default n 270fd5f4e90SDmitry Kasatkin help 271fd5f4e90SDmitry Kasatkin File signature verification is based on the public keys 272fd5f4e90SDmitry Kasatkin loaded on the .ima trusted keyring. These public keys are 273fd5f4e90SDmitry Kasatkin X509 certificates signed by a trusted key on the 274fd5f4e90SDmitry Kasatkin .system keyring. This option enables X509 certificate 275fd5f4e90SDmitry Kasatkin loading from the kernel onto the '.ima' trusted keyring. 276fd5f4e90SDmitry Kasatkin 277fd5f4e90SDmitry Kasatkinconfig IMA_X509_PATH 278fd5f4e90SDmitry Kasatkin string "IMA X509 certificate path" 279fd5f4e90SDmitry Kasatkin depends on IMA_LOAD_X509 280fd5f4e90SDmitry Kasatkin default "/etc/keys/x509_ima.der" 281fd5f4e90SDmitry Kasatkin help 282fd5f4e90SDmitry Kasatkin This option defines IMA X509 certificate path. 283c57782c1SDmitry Kasatkin 284c57782c1SDmitry Kasatkinconfig IMA_APPRAISE_SIGNED_INIT 285c57782c1SDmitry Kasatkin bool "Require signed user-space initialization" 286c57782c1SDmitry Kasatkin depends on IMA_LOAD_X509 287c57782c1SDmitry Kasatkin default n 288c57782c1SDmitry Kasatkin help 289c57782c1SDmitry Kasatkin This option requires user-space init to be signed. 290