1# SPDX-License-Identifier: GPL-2.0-only 2# 3# Integrity Policy Enforcement (IPE) configuration 4# 5 6menuconfig SECURITY_IPE 7 bool "Integrity Policy Enforcement (IPE)" 8 depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL 9 select PKCS7_MESSAGE_PARSER 10 select SYSTEM_DATA_VERIFICATION 11 select IPE_PROP_DM_VERITY if DM_VERITY 12 select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG 13 select IPE_PROP_FS_VERITY if FS_VERITY 14 select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES 15 help 16 This option enables the Integrity Policy Enforcement LSM 17 allowing users to define a policy to enforce a trust-based access 18 control. A key feature of IPE is a customizable policy to allow 19 admins to reconfigure trust requirements on the fly. 20 21 If unsure, answer N. 22 23if SECURITY_IPE 24menu "IPE Trust Providers" 25 26config IPE_PROP_DM_VERITY 27 bool "Enable support for dm-verity based on root hash" 28 depends on DM_VERITY 29 help 30 This option enables the 'dmverity_roothash' property within IPE 31 policies. The property evaluates to TRUE when a file from a dm-verity 32 volume is evaluated, and the volume's root hash matches the value 33 supplied in the policy. 34 35config IPE_PROP_DM_VERITY_SIGNATURE 36 bool "Enable support for dm-verity based on root hash signature" 37 depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG 38 help 39 This option enables the 'dmverity_signature' property within IPE 40 policies. The property evaluates to TRUE when a file from a dm-verity 41 volume, which has been mounted with a valid signed root hash, 42 is evaluated. 43 44 If unsure, answer Y. 45 46config IPE_PROP_FS_VERITY 47 bool "Enable support for fs-verity based on file digest" 48 depends on FS_VERITY 49 help 50 This option enables the 'fsverity_digest' property within IPE 51 policies. The property evaluates to TRUE when a file is fsverity 52 enabled and its digest matches the supplied digest value in the 53 policy. 54 55 if unsure, answer Y. 56 57config IPE_PROP_FS_VERITY_BUILTIN_SIG 58 bool "Enable support for fs-verity based on builtin signature" 59 depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES 60 help 61 This option enables the 'fsverity_signature' property within IPE 62 policies. The property evaluates to TRUE when a file is fsverity 63 enabled and it has a valid builtin signature whose signing cert 64 is in the .fs-verity keyring. 65 66 if unsure, answer Y. 67 68endmenu 69 70endif 71