13323eec9SMimi Zohar# IBM Integrity Measurement Architecture 23323eec9SMimi Zohar# 33323eec9SMimi Zoharconfig IMA 43323eec9SMimi Zohar bool "Integrity Measurement Architecture(IMA)" 53323eec9SMimi Zohar select SECURITYFS 63323eec9SMimi Zohar select CRYPTO 73323eec9SMimi Zohar select CRYPTO_HMAC 83323eec9SMimi Zohar select CRYPTO_MD5 93323eec9SMimi Zohar select CRYPTO_SHA1 10c7c8bb23SDmitry Kasatkin select CRYPTO_HASH_INFO 11f4a0391dSFabio Estevam select TCG_TPM if HAS_IOMEM && !UML 12a69f1589SRandy Dunlap select TCG_TIS if TCG_TPM && X86 13*fac37c62SJiandi An select TCG_CRB if TCG_TPM && ACPI 1463a0eb78SMichael Ellerman select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES 153323eec9SMimi Zohar help 163323eec9SMimi Zohar The Trusted Computing Group(TCG) runtime Integrity 173323eec9SMimi Zohar Measurement Architecture(IMA) maintains a list of hash 183323eec9SMimi Zohar values of executables and other sensitive system files, 193323eec9SMimi Zohar as they are read or executed. If an attacker manages 203323eec9SMimi Zohar to change the contents of an important system file 213323eec9SMimi Zohar being measured, we can tell. 223323eec9SMimi Zohar 233323eec9SMimi Zohar If your system has a TPM chip, then IMA also maintains 243323eec9SMimi Zohar an aggregate integrity value over this list inside the 253323eec9SMimi Zohar TPM hardware, so that the TPM can prove to a third party 263323eec9SMimi Zohar whether or not critical system files have been modified. 273323eec9SMimi Zohar Read <http://www.usenix.org/events/sec04/tech/sailer.html> 283323eec9SMimi Zohar to learn more about IMA. 293323eec9SMimi Zohar If unsure, say N. 303323eec9SMimi Zohar 31d158847aSMimi Zoharconfig IMA_KEXEC 32d158847aSMimi Zohar bool "Enable carrying the IMA measurement list across a soft boot" 33d158847aSMimi Zohar depends on IMA && TCG_TPM && HAVE_IMA_KEXEC 34d158847aSMimi Zohar default n 35d158847aSMimi Zohar help 36d158847aSMimi Zohar TPM PCRs are only reset on a hard reboot. In order to validate 37d158847aSMimi Zohar a TPM's quote after a soft boot, the IMA measurement list of the 38d158847aSMimi Zohar running kernel must be saved and restored on boot. 39d158847aSMimi Zohar 40d158847aSMimi Zohar Depending on the IMA policy, the measurement list can grow to 41d158847aSMimi Zohar be very large. 42d158847aSMimi Zohar 433323eec9SMimi Zoharconfig IMA_MEASURE_PCR_IDX 443323eec9SMimi Zohar int 453323eec9SMimi Zohar depends on IMA 463323eec9SMimi Zohar range 8 14 473323eec9SMimi Zohar default 10 483323eec9SMimi Zohar help 493323eec9SMimi Zohar IMA_MEASURE_PCR_IDX determines the TPM PCR register index 503323eec9SMimi Zohar that IMA uses to maintain the integrity aggregate of the 513323eec9SMimi Zohar measurement list. If unsure, use the default 10. 523323eec9SMimi Zohar 534af4662fSMimi Zoharconfig IMA_LSM_RULES 544af4662fSMimi Zohar bool 55b53fab9dSRandy Dunlap depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK) 564af4662fSMimi Zohar default y 574af4662fSMimi Zohar help 58b53fab9dSRandy Dunlap Disabling this option will disregard LSM based policy rules. 592fe5d6deSMimi Zohar 604286587dSMimi Zoharchoice 614286587dSMimi Zohar prompt "Default template" 624286587dSMimi Zohar default IMA_NG_TEMPLATE 634286587dSMimi Zohar depends on IMA 644286587dSMimi Zohar help 654286587dSMimi Zohar Select the default IMA measurement template. 664286587dSMimi Zohar 674286587dSMimi Zohar The original 'ima' measurement list template contains a 684286587dSMimi Zohar hash, defined as 20 bytes, and a null terminated pathname, 694286587dSMimi Zohar limited to 255 characters. The 'ima-ng' measurement list 704286587dSMimi Zohar template permits both larger hash digests and longer 714286587dSMimi Zohar pathnames. 724286587dSMimi Zohar 734286587dSMimi Zohar config IMA_TEMPLATE 744286587dSMimi Zohar bool "ima" 754286587dSMimi Zohar config IMA_NG_TEMPLATE 764286587dSMimi Zohar bool "ima-ng (default)" 77bcbc9b0cSMimi Zohar config IMA_SIG_TEMPLATE 78bcbc9b0cSMimi Zohar bool "ima-sig" 794286587dSMimi Zoharendchoice 804286587dSMimi Zohar 814286587dSMimi Zoharconfig IMA_DEFAULT_TEMPLATE 824286587dSMimi Zohar string 834286587dSMimi Zohar depends on IMA 844286587dSMimi Zohar default "ima" if IMA_TEMPLATE 854286587dSMimi Zohar default "ima-ng" if IMA_NG_TEMPLATE 86bcbc9b0cSMimi Zohar default "ima-sig" if IMA_SIG_TEMPLATE 874286587dSMimi Zohar 88e7a2ad7eSMimi Zoharchoice 89e7a2ad7eSMimi Zohar prompt "Default integrity hash algorithm" 90e7a2ad7eSMimi Zohar default IMA_DEFAULT_HASH_SHA1 91e7a2ad7eSMimi Zohar depends on IMA 92e7a2ad7eSMimi Zohar help 93e7a2ad7eSMimi Zohar Select the default hash algorithm used for the measurement 94e7a2ad7eSMimi Zohar list, integrity appraisal and audit log. The compiled default 95e7a2ad7eSMimi Zohar hash algorithm can be overwritten using the kernel command 96e7a2ad7eSMimi Zohar line 'ima_hash=' option. 97e7a2ad7eSMimi Zohar 98e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA1 99e7a2ad7eSMimi Zohar bool "SHA1 (default)" 10038d19268SBen Hutchings depends on CRYPTO_SHA1=y 101e7a2ad7eSMimi Zohar 102e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA256 103e7a2ad7eSMimi Zohar bool "SHA256" 10438d19268SBen Hutchings depends on CRYPTO_SHA256=y && !IMA_TEMPLATE 105e7a2ad7eSMimi Zohar 106e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_SHA512 107e7a2ad7eSMimi Zohar bool "SHA512" 10838d19268SBen Hutchings depends on CRYPTO_SHA512=y && !IMA_TEMPLATE 109e7a2ad7eSMimi Zohar 110e7a2ad7eSMimi Zohar config IMA_DEFAULT_HASH_WP512 111e7a2ad7eSMimi Zohar bool "WP512" 11238d19268SBen Hutchings depends on CRYPTO_WP512=y && !IMA_TEMPLATE 113e7a2ad7eSMimi Zoharendchoice 114e7a2ad7eSMimi Zohar 115e7a2ad7eSMimi Zoharconfig IMA_DEFAULT_HASH 116e7a2ad7eSMimi Zohar string 117e7a2ad7eSMimi Zohar depends on IMA 118e7a2ad7eSMimi Zohar default "sha1" if IMA_DEFAULT_HASH_SHA1 119e7a2ad7eSMimi Zohar default "sha256" if IMA_DEFAULT_HASH_SHA256 120e7a2ad7eSMimi Zohar default "sha512" if IMA_DEFAULT_HASH_SHA512 121e7a2ad7eSMimi Zohar default "wp512" if IMA_DEFAULT_HASH_WP512 122e7a2ad7eSMimi Zohar 12338d859f9SPetko Manolovconfig IMA_WRITE_POLICY 12438d859f9SPetko Manolov bool "Enable multiple writes to the IMA policy" 12538d859f9SPetko Manolov depends on IMA 12638d859f9SPetko Manolov default n 12738d859f9SPetko Manolov help 12838d859f9SPetko Manolov IMA policy can now be updated multiple times. The new rules get 12938d859f9SPetko Manolov appended to the original policy. Have in mind that the rules are 13038d859f9SPetko Manolov scanned in FIFO order so be careful when you design and add new ones. 13138d859f9SPetko Manolov 13238d859f9SPetko Manolov If unsure, say N. 13338d859f9SPetko Manolov 13480eae209SPetko Manolovconfig IMA_READ_POLICY 13580eae209SPetko Manolov bool "Enable reading back the current IMA policy" 13680eae209SPetko Manolov depends on IMA 13780eae209SPetko Manolov default y if IMA_WRITE_POLICY 13880eae209SPetko Manolov default n if !IMA_WRITE_POLICY 13980eae209SPetko Manolov help 14080eae209SPetko Manolov It is often useful to be able to read back the IMA policy. It is 14180eae209SPetko Manolov even more important after introducing CONFIG_IMA_WRITE_POLICY. 14280eae209SPetko Manolov This option allows the root user to see the current policy rules. 14380eae209SPetko Manolov 1442fe5d6deSMimi Zoharconfig IMA_APPRAISE 1452fe5d6deSMimi Zohar bool "Appraise integrity measurements" 1462fe5d6deSMimi Zohar depends on IMA 1472fe5d6deSMimi Zohar default n 1482fe5d6deSMimi Zohar help 1492fe5d6deSMimi Zohar This option enables local measurement integrity appraisal. 1502fe5d6deSMimi Zohar It requires the system to be labeled with a security extended 1512fe5d6deSMimi Zohar attribute containing the file hash measurement. To protect 1522fe5d6deSMimi Zohar the security extended attributes from offline attack, enable 1532fe5d6deSMimi Zohar and configure EVM. 1542fe5d6deSMimi Zohar 1552fe5d6deSMimi Zohar For more information on integrity appraisal refer to: 1562fe5d6deSMimi Zohar <http://linux-ima.sourceforge.net> 1572fe5d6deSMimi Zohar If unsure, say N. 1587d2ce232SMimi Zohar 159e1f5e01fSMimi Zoharconfig IMA_APPRAISE_BOOTPARAM 160e1f5e01fSMimi Zohar bool "ima_appraise boot parameter" 161e1f5e01fSMimi Zohar depends on IMA_APPRAISE 162e1f5e01fSMimi Zohar default y 163e1f5e01fSMimi Zohar help 164e1f5e01fSMimi Zohar This option enables the different "ima_appraise=" modes 165e1f5e01fSMimi Zohar (eg. fix, log) from the boot command line. 166e1f5e01fSMimi Zohar 1677d2ce232SMimi Zoharconfig IMA_TRUSTED_KEYRING 168f4dc3778SDmitry Kasatkin bool "Require all keys on the .ima keyring be signed (deprecated)" 1697d2ce232SMimi Zohar depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING 1707d2ce232SMimi Zohar depends on INTEGRITY_ASYMMETRIC_KEYS 171f4dc3778SDmitry Kasatkin select INTEGRITY_TRUSTED_KEYRING 1727d2ce232SMimi Zohar default y 1737d2ce232SMimi Zohar help 1747d2ce232SMimi Zohar This option requires that all keys added to the .ima 1757d2ce232SMimi Zohar keyring be signed by a key on the system trusted keyring. 176fd5f4e90SDmitry Kasatkin 177f4dc3778SDmitry Kasatkin This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING 178f4dc3778SDmitry Kasatkin 17956104cf2SDavid Howellsconfig IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY 18056104cf2SDavid Howells bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" 18156104cf2SDavid Howells depends on SYSTEM_TRUSTED_KEYRING 18256104cf2SDavid Howells depends on SECONDARY_TRUSTED_KEYRING 18356104cf2SDavid Howells depends on INTEGRITY_ASYMMETRIC_KEYS 18456104cf2SDavid Howells select INTEGRITY_TRUSTED_KEYRING 18556104cf2SDavid Howells default n 18656104cf2SDavid Howells help 18756104cf2SDavid Howells Keys may be added to the IMA or IMA blacklist keyrings, if the 18856104cf2SDavid Howells key is validly signed by a CA cert in the system built-in or 18956104cf2SDavid Howells secondary trusted keyrings. 19056104cf2SDavid Howells 19156104cf2SDavid Howells Intermediate keys between those the kernel has compiled in and the 19256104cf2SDavid Howells IMA keys to be added may be added to the system secondary keyring, 19356104cf2SDavid Howells provided they are validly signed by a key already resident in the 19456104cf2SDavid Howells built-in or secondary trusted keyrings. 19556104cf2SDavid Howells 19656104cf2SDavid Howellsconfig IMA_BLACKLIST_KEYRING 19756104cf2SDavid Howells bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)" 19841c89b64SPetko Manolov depends on SYSTEM_TRUSTED_KEYRING 19941c89b64SPetko Manolov depends on IMA_TRUSTED_KEYRING 20041c89b64SPetko Manolov default n 20141c89b64SPetko Manolov help 20256104cf2SDavid Howells This option creates an IMA blacklist keyring, which contains all 20356104cf2SDavid Howells revoked IMA keys. It is consulted before any other keyring. If 20456104cf2SDavid Howells the search is successful the requested operation is rejected and 20556104cf2SDavid Howells an error is returned to the caller. 20641c89b64SPetko Manolov 207fd5f4e90SDmitry Kasatkinconfig IMA_LOAD_X509 208fd5f4e90SDmitry Kasatkin bool "Load X509 certificate onto the '.ima' trusted keyring" 209fd5f4e90SDmitry Kasatkin depends on IMA_TRUSTED_KEYRING 210fd5f4e90SDmitry Kasatkin default n 211fd5f4e90SDmitry Kasatkin help 212fd5f4e90SDmitry Kasatkin File signature verification is based on the public keys 213fd5f4e90SDmitry Kasatkin loaded on the .ima trusted keyring. These public keys are 214fd5f4e90SDmitry Kasatkin X509 certificates signed by a trusted key on the 215fd5f4e90SDmitry Kasatkin .system keyring. This option enables X509 certificate 216fd5f4e90SDmitry Kasatkin loading from the kernel onto the '.ima' trusted keyring. 217fd5f4e90SDmitry Kasatkin 218fd5f4e90SDmitry Kasatkinconfig IMA_X509_PATH 219fd5f4e90SDmitry Kasatkin string "IMA X509 certificate path" 220fd5f4e90SDmitry Kasatkin depends on IMA_LOAD_X509 221fd5f4e90SDmitry Kasatkin default "/etc/keys/x509_ima.der" 222fd5f4e90SDmitry Kasatkin help 223fd5f4e90SDmitry Kasatkin This option defines IMA X509 certificate path. 224c57782c1SDmitry Kasatkin 225c57782c1SDmitry Kasatkinconfig IMA_APPRAISE_SIGNED_INIT 226c57782c1SDmitry Kasatkin bool "Require signed user-space initialization" 227c57782c1SDmitry Kasatkin depends on IMA_LOAD_X509 228c57782c1SDmitry Kasatkin default n 229c57782c1SDmitry Kasatkin help 230c57782c1SDmitry Kasatkin This option requires user-space init to be signed. 231