13323eec9SMimi Zohar# IBM Integrity Measurement Architecture 23323eec9SMimi Zohar# 33323eec9SMimi Zoharconfig IMA 43323eec9SMimi Zohar bool "Integrity Measurement Architecture(IMA)" 53323eec9SMimi Zohar select SECURITYFS 63323eec9SMimi Zohar select CRYPTO 73323eec9SMimi Zohar select CRYPTO_HMAC 83323eec9SMimi Zohar select CRYPTO_MD5 93323eec9SMimi Zohar select CRYPTO_SHA1 10c7c8bb23SDmitry Kasatkin select CRYPTO_HASH_INFO 11f4a0391dSFabio Estevam select TCG_TPM if HAS_IOMEM && !UML 12a69f1589SRandy Dunlap select TCG_TIS if TCG_TPM && X86 1363a0eb78SMichael Ellerman select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES 143323eec9SMimi Zohar help 153323eec9SMimi Zohar The Trusted Computing Group(TCG) runtime Integrity 163323eec9SMimi Zohar Measurement Architecture(IMA) maintains a list of hash 173323eec9SMimi Zohar values of executables and other sensitive system files, 183323eec9SMimi Zohar as they are read or executed. If an attacker manages 193323eec9SMimi Zohar to change the contents of an important system file 203323eec9SMimi Zohar being measured, we can tell. 213323eec9SMimi Zohar 223323eec9SMimi Zohar If your system has a TPM chip, then IMA also maintains 233323eec9SMimi Zohar an aggregate integrity value over this list inside the 243323eec9SMimi Zohar TPM hardware, so that the TPM can prove to a third party 253323eec9SMimi Zohar whether or not critical system files have been modified. 263323eec9SMimi Zohar Read <http://www.usenix.org/events/sec04/tech/sailer.html> 273323eec9SMimi Zohar to learn more about IMA. 283323eec9SMimi Zohar If unsure, say N. 293323eec9SMimi Zohar 30*d158847aSMimi Zoharconfig IMA_KEXEC 31*d158847aSMimi Zohar bool "Enable carrying the IMA measurement list across a soft boot" 32*d158847aSMimi Zohar depends on IMA && TCG_TPM && HAVE_IMA_KEXEC 33*d158847aSMimi Zohar default n 34*d158847aSMimi Zohar help 35*d158847aSMimi Zohar TPM PCRs are only reset on a hard reboot. In order to validate 36*d158847aSMimi Zohar a TPM's quote after a soft boot, the IMA measurement list of the 37*d158847aSMimi Zohar running kernel must be saved and restored on boot. 38*d158847aSMimi Zohar 39*d158847aSMimi Zohar Depending on the IMA policy, the measurement list can grow to 40*d158847aSMimi Zohar be very large. 41*d158847aSMimi Zohar 423323eec9SMimi Zoharconfig IMA_MEASURE_PCR_IDX 433323eec9SMimi Zohar int 443323eec9SMimi Zohar depends on IMA 453323eec9SMimi Zohar range 8 14 463323eec9SMimi Zohar default 10 473323eec9SMimi Zohar help 483323eec9SMimi Zohar IMA_MEASURE_PCR_IDX determines the TPM PCR register index 493323eec9SMimi Zohar that IMA uses to maintain the integrity aggregate of the 503323eec9SMimi Zohar measurement list. If unsure, use the default 10. 513323eec9SMimi Zohar 524af4662fSMimi Zoharconfig IMA_LSM_RULES 534af4662fSMimi Zohar bool 54b53fab9dSRandy Dunlap depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK) 554af4662fSMimi Zohar default y 564af4662fSMimi Zohar help 57b53fab9dSRandy Dunlap Disabling this option will disregard LSM based policy rules. 582fe5d6deSMimi Zohar 594286587dSMimi Zoharchoice 604286587dSMimi Zohar prompt "Default template" 614286587dSMimi Zohar default IMA_NG_TEMPLATE 624286587dSMimi Zohar depends on IMA 634286587dSMimi Zohar help 644286587dSMimi Zohar Select the default IMA measurement template. 654286587dSMimi Zohar 664286587dSMimi Zohar The original 'ima' measurement list template contains a 674286587dSMimi Zohar hash, defined as 20 bytes, and a null terminated pathname, 684286587dSMimi Zohar limited to 255 characters. The 'ima-ng' measurement list 694286587dSMimi Zohar template permits both larger hash digests and longer 704286587dSMimi Zohar pathnames. 714286587dSMimi Zohar 724286587dSMimi Zohar config IMA_TEMPLATE 734286587dSMimi Zohar bool "ima" 744286587dSMimi Zohar config IMA_NG_TEMPLATE 754286587dSMimi Zohar bool "ima-ng (default)" 76bcbc9b0cSMimi Zohar config IMA_SIG_TEMPLATE 77bcbc9b0cSMimi Zohar bool "ima-sig" 784286587dSMimi Zoharendchoice 794286587dSMimi Zohar 804286587dSMimi Zoharconfig IMA_DEFAULT_TEMPLATE 814286587dSMimi Zohar string 824286587dSMimi Zohar depends on IMA 834286587dSMimi Zohar default "ima" if IMA_TEMPLATE 844286587dSMimi Zohar default "ima-ng" if IMA_NG_TEMPLATE 85bcbc9b0cSMimi Zohar default "ima-sig" if IMA_SIG_TEMPLATE 864286587dSMimi Zohar 87e7a2ad7eSMimi Zoharchoice 88e7a2ad7eSMimi Zohar prompt "Default integrity hash algorithm" 89e7a2ad7eSMimi Zohar default IMA_DEFAULT_HASH_SHA1 90e7a2ad7eSMimi Zohar depends on IMA 91e7a2ad7eSMimi Zohar help 92e7a2ad7eSMimi Zohar Select the default hash algorithm used for the measurement 93e7a2ad7eSMimi Zohar list, integrity appraisal and audit log. The compiled default 94e7a2ad7eSMimi Zohar hash algorithm can be overwritten using the kernel command 95e7a2ad7eSMimi Zohar line 'ima_hash=' option. 96e7a2ad7eSMimi Zohar 97e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA1 98e7a2ad7eSMimi Zohar bool "SHA1 (default)" 99e7a2ad7eSMimi Zohar depends on CRYPTO_SHA1 100e7a2ad7eSMimi Zohar 101e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA256 102e7a2ad7eSMimi Zohar bool "SHA256" 103e7a2ad7eSMimi Zohar depends on CRYPTO_SHA256 && !IMA_TEMPLATE 104e7a2ad7eSMimi Zohar 105e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA512 106e7a2ad7eSMimi Zohar bool "SHA512" 107e7a2ad7eSMimi Zohar depends on CRYPTO_SHA512 && !IMA_TEMPLATE 108e7a2ad7eSMimi Zohar 109e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_WP512 110e7a2ad7eSMimi Zohar bool "WP512" 111e7a2ad7eSMimi Zohar depends on CRYPTO_WP512 && !IMA_TEMPLATE 112e7a2ad7eSMimi Zoharendchoice 113e7a2ad7eSMimi Zohar 114e7a2ad7eSMimi Zoharconfig IMA_DEFAULT_HASH 115e7a2ad7eSMimi Zohar string 116e7a2ad7eSMimi Zohar depends on IMA 117e7a2ad7eSMimi Zohar default "sha1" if IMA_DEFAULT_HASH_SHA1 118e7a2ad7eSMimi Zohar default "sha256" if IMA_DEFAULT_HASH_SHA256 119e7a2ad7eSMimi Zohar default "sha512" if IMA_DEFAULT_HASH_SHA512 120e7a2ad7eSMimi Zohar default "wp512" if IMA_DEFAULT_HASH_WP512 121e7a2ad7eSMimi Zohar 12238d859f9SPetko Manolovconfig IMA_WRITE_POLICY 12338d859f9SPetko Manolov bool "Enable multiple writes to the IMA policy" 12438d859f9SPetko Manolov depends on IMA 12538d859f9SPetko Manolov default n 12638d859f9SPetko Manolov help 12738d859f9SPetko Manolov IMA policy can now be updated multiple times. The new rules get 12838d859f9SPetko Manolov appended to the original policy. Have in mind that the rules are 12938d859f9SPetko Manolov scanned in FIFO order so be careful when you design and add new ones. 13038d859f9SPetko Manolov 13138d859f9SPetko Manolov If unsure, say N. 13238d859f9SPetko Manolov 13380eae209SPetko Manolovconfig IMA_READ_POLICY 13480eae209SPetko Manolov bool "Enable reading back the current IMA policy" 13580eae209SPetko Manolov depends on IMA 13680eae209SPetko Manolov default y if IMA_WRITE_POLICY 13780eae209SPetko Manolov default n if !IMA_WRITE_POLICY 13880eae209SPetko Manolov help 13980eae209SPetko Manolov It is often useful to be able to read back the IMA policy. It is 14080eae209SPetko Manolov even more important after introducing CONFIG_IMA_WRITE_POLICY. 14180eae209SPetko Manolov This option allows the root user to see the current policy rules. 14280eae209SPetko Manolov 1432fe5d6deSMimi Zoharconfig IMA_APPRAISE 1442fe5d6deSMimi Zohar bool "Appraise integrity measurements" 1452fe5d6deSMimi Zohar depends on IMA 1462fe5d6deSMimi Zohar default n 1472fe5d6deSMimi Zohar help 1482fe5d6deSMimi Zohar This option enables local measurement integrity appraisal. 1492fe5d6deSMimi Zohar It requires the system to be labeled with a security extended 1502fe5d6deSMimi Zohar attribute containing the file hash measurement. To protect 1512fe5d6deSMimi Zohar the security extended attributes from offline attack, enable 1522fe5d6deSMimi Zohar and configure EVM. 1532fe5d6deSMimi Zohar 1542fe5d6deSMimi Zohar For more information on integrity appraisal refer to: 1552fe5d6deSMimi Zohar <http://linux-ima.sourceforge.net> 1562fe5d6deSMimi Zohar If unsure, say N. 1577d2ce232SMimi Zohar 1587d2ce232SMimi Zoharconfig IMA_TRUSTED_KEYRING 159f4dc3778SDmitry Kasatkin bool "Require all keys on the .ima keyring be signed (deprecated)" 1607d2ce232SMimi Zohar depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING 1617d2ce232SMimi Zohar depends on INTEGRITY_ASYMMETRIC_KEYS 162f4dc3778SDmitry Kasatkin select INTEGRITY_TRUSTED_KEYRING 1637d2ce232SMimi Zohar default y 1647d2ce232SMimi Zohar help 1657d2ce232SMimi Zohar This option requires that all keys added to the .ima 1667d2ce232SMimi Zohar keyring be signed by a key on the system trusted keyring. 167fd5f4e90SDmitry Kasatkin 168f4dc3778SDmitry Kasatkin This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING 169f4dc3778SDmitry Kasatkin 17056104cf2SDavid Howellsconfig IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY 17156104cf2SDavid Howells bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" 17256104cf2SDavid Howells depends on SYSTEM_TRUSTED_KEYRING 17356104cf2SDavid Howells depends on SECONDARY_TRUSTED_KEYRING 17456104cf2SDavid Howells depends on INTEGRITY_ASYMMETRIC_KEYS 17556104cf2SDavid Howells select INTEGRITY_TRUSTED_KEYRING 17656104cf2SDavid Howells default n 17756104cf2SDavid Howells help 17856104cf2SDavid Howells Keys may be added to the IMA or IMA blacklist keyrings, if the 17956104cf2SDavid Howells key is validly signed by a CA cert in the system built-in or 18056104cf2SDavid Howells secondary trusted keyrings. 18156104cf2SDavid Howells 18256104cf2SDavid Howells Intermediate keys between those the kernel has compiled in and the 18356104cf2SDavid Howells IMA keys to be added may be added to the system secondary keyring, 18456104cf2SDavid Howells provided they are validly signed by a key already resident in the 18556104cf2SDavid Howells built-in or secondary trusted keyrings. 18656104cf2SDavid Howells 18756104cf2SDavid Howellsconfig IMA_BLACKLIST_KEYRING 18856104cf2SDavid Howells bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" 18941c89b64SPetko Manolov depends on SYSTEM_TRUSTED_KEYRING 19041c89b64SPetko Manolov depends on IMA_TRUSTED_KEYRING 19141c89b64SPetko Manolov default n 19241c89b64SPetko Manolov help 19356104cf2SDavid Howells This option creates an IMA blacklist keyring, which contains all 19456104cf2SDavid Howells revoked IMA keys. It is consulted before any other keyring. If 19556104cf2SDavid Howells the search is successful the requested operation is rejected and 19656104cf2SDavid Howells an error is returned to the caller. 19741c89b64SPetko Manolov 198fd5f4e90SDmitry Kasatkinconfig IMA_LOAD_X509 199fd5f4e90SDmitry Kasatkin bool "Load X509 certificate onto the '.ima' trusted keyring" 200fd5f4e90SDmitry Kasatkin depends on IMA_TRUSTED_KEYRING 201fd5f4e90SDmitry Kasatkin default n 202fd5f4e90SDmitry Kasatkin help 203fd5f4e90SDmitry Kasatkin File signature verification is based on the public keys 204fd5f4e90SDmitry Kasatkin loaded on the .ima trusted keyring. These public keys are 205fd5f4e90SDmitry Kasatkin X509 certificates signed by a trusted key on the 206fd5f4e90SDmitry Kasatkin .system keyring. This option enables X509 certificate 207fd5f4e90SDmitry Kasatkin loading from the kernel onto the '.ima' trusted keyring. 208fd5f4e90SDmitry Kasatkin 209fd5f4e90SDmitry Kasatkinconfig IMA_X509_PATH 210fd5f4e90SDmitry Kasatkin string "IMA X509 certificate path" 211fd5f4e90SDmitry Kasatkin depends on IMA_LOAD_X509 212fd5f4e90SDmitry Kasatkin default "/etc/keys/x509_ima.der" 213fd5f4e90SDmitry Kasatkin help 214fd5f4e90SDmitry Kasatkin This option defines IMA X509 certificate path. 215c57782c1SDmitry Kasatkin 216c57782c1SDmitry Kasatkinconfig IMA_APPRAISE_SIGNED_INIT 217c57782c1SDmitry Kasatkin bool "Require signed user-space initialization" 218c57782c1SDmitry Kasatkin depends on IMA_LOAD_X509 219c57782c1SDmitry Kasatkin default n 220c57782c1SDmitry Kasatkin help 221c57782c1SDmitry Kasatkin This option requires user-space init to be signed. 222