1# SPDX-License-Identifier: GPL-2.0-only 2# 3# Integrity Policy Enforcement (IPE) configuration 4# 5 6menuconfig SECURITY_IPE 7 bool "Integrity Policy Enforcement (IPE)" 8 depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL 9 select PKCS7_MESSAGE_PARSER 10 select SYSTEM_DATA_VERIFICATION 11 select IPE_PROP_DM_VERITY if DM_VERITY 12 select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG 13 select IPE_PROP_FS_VERITY if FS_VERITY 14 select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES 15 help 16 This option enables the Integrity Policy Enforcement LSM 17 allowing users to define a policy to enforce a trust-based access 18 control. A key feature of IPE is a customizable policy to allow 19 admins to reconfigure trust requirements on the fly. 20 21 If unsure, answer N. 22 23if SECURITY_IPE 24config IPE_BOOT_POLICY 25 string "Integrity policy to apply on system startup" 26 help 27 This option specifies a filepath to an IPE policy that is compiled 28 into the kernel. This policy will be enforced until a policy update 29 is deployed via the $securityfs/ipe/policies/$policy_name/active 30 interface. 31 32 If unsure, leave blank. 33 34menu "IPE Trust Providers" 35 36config IPE_PROP_DM_VERITY 37 bool "Enable support for dm-verity based on root hash" 38 depends on DM_VERITY 39 help 40 This option enables the 'dmverity_roothash' property within IPE 41 policies. The property evaluates to TRUE when a file from a dm-verity 42 volume is evaluated, and the volume's root hash matches the value 43 supplied in the policy. 44 45config IPE_PROP_DM_VERITY_SIGNATURE 46 bool "Enable support for dm-verity based on root hash signature" 47 depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG 48 help 49 This option enables the 'dmverity_signature' property within IPE 50 policies. The property evaluates to TRUE when a file from a dm-verity 51 volume, which has been mounted with a valid signed root hash, 52 is evaluated. 53 54 If unsure, answer Y. 55 56config IPE_PROP_FS_VERITY 57 bool "Enable support for fs-verity based on file digest" 58 depends on FS_VERITY 59 help 60 This option enables the 'fsverity_digest' property within IPE 61 policies. The property evaluates to TRUE when a file is fsverity 62 enabled and its digest matches the supplied digest value in the 63 policy. 64 65 if unsure, answer Y. 66 67config IPE_PROP_FS_VERITY_BUILTIN_SIG 68 bool "Enable support for fs-verity based on builtin signature" 69 depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES 70 help 71 This option enables the 'fsverity_signature' property within IPE 72 policies. The property evaluates to TRUE when a file is fsverity 73 enabled and it has a valid builtin signature whose signing cert 74 is in the .fs-verity keyring. 75 76 if unsure, answer Y. 77 78endmenu 79 80endif 81