| # SPDX-License-Identifier: GPL-2.0 | |
| menu "Certificates for signature checking" | |
| config MODULE_SIG_KEY | |
| string "File name or PKCS#11 URI of module signing key" | |
| default "certs/signing_key.pem" | |
| depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) | |
| help | |
| Provide the file name of a private key/certificate in PEM format, | |
| or a PKCS#11 URI according to RFC7512. The file should contain, or | |
| the URI should identify, both the certificate and its corresponding | |
| private key. | |
| If this option is unchanged from its default "certs/signing_key.pem", | |
| then the kernel will automatically generate the private key and | |
| certificate as described in Documentation/admin-guide/module-signing.rst | |
| choice | |
| prompt "Type of module signing key to be generated" | |
| depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES) | |
| help | |
| The type of module signing key type to generate. This option | |
| does not apply if a #PKCS11 URI is used. | |
| config MODULE_SIG_KEY_TYPE_RSA | |
| bool "RSA" | |
| help | |
| Use an RSA key for module signing. | |
| config MODULE_SIG_KEY_TYPE_ECDSA | |
| bool "ECDSA" | |
| select CRYPTO_ECDSA | |
| depends on !(MODULE_SIG_SHA256 || MODULE_SIG_SHA3_256) | |
| help | |
| Use an elliptic curve key (NIST P384) for module signing. Use | |
| a strong hash of same or higher bit length, i.e. sha384 or | |
| sha512 for hashing modules. | |
| Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem, | |
| when falling back to building Linux 5.14 and older kernels. | |
| endchoice | |
| config SYSTEM_TRUSTED_KEYRING | |
| bool "Provide system-wide ring of trusted keys" | |
| depends on KEYS | |
| depends on ASYMMETRIC_KEY_TYPE | |
| depends on X509_CERTIFICATE_PARSER = y | |
| help | |
| Provide a system keyring to which trusted keys can be added. Keys in | |
| the keyring are considered to be trusted. Keys may be added at will | |
| by the kernel from compiled-in data and from hardware key stores, but | |
| userspace may only add extra keys if those keys can be verified by | |
| keys already in the keyring. | |
| Keys in this keyring are used by module signature checking. | |
| config SYSTEM_TRUSTED_KEYS | |
| string "Additional X.509 keys for default system keyring" | |
| depends on SYSTEM_TRUSTED_KEYRING | |
| help | |
| If set, this option should be the filename of a PEM-formatted file | |
| containing trusted X.509 certificates to be included in the default | |
| system keyring. Any certificate used for module signing is implicitly | |
| also trusted. | |
| NOTE: If you previously provided keys for the system keyring in the | |
| form of DER-encoded *.x509 files in the top-level build directory, | |
| those are no longer used. You will need to set this option instead. | |
| config SYSTEM_EXTRA_CERTIFICATE | |
| bool "Reserve area for inserting a certificate without recompiling" | |
| depends on SYSTEM_TRUSTED_KEYRING | |
| help | |
| If set, space for an extra certificate will be reserved in the kernel | |
| image. This allows introducing a trusted certificate to the default | |
| system keyring without recompiling the kernel. | |
| config SYSTEM_EXTRA_CERTIFICATE_SIZE | |
| int "Number of bytes to reserve for the extra certificate" | |
| depends on SYSTEM_EXTRA_CERTIFICATE | |
| default 4096 | |
| help | |
| This is the number of bytes reserved in the kernel image for a | |
| certificate to be inserted. | |
| config SECONDARY_TRUSTED_KEYRING | |
| bool "Provide a keyring to which extra trustable keys may be added" | |
| depends on SYSTEM_TRUSTED_KEYRING | |
| help | |
| If set, provide a keyring to which extra keys may be added, provided | |
| those keys are not blacklisted and are vouched for by a key built | |
| into the kernel, machine keyring (if configured), or already in the | |
| secondary trusted keyring. | |
| config SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN | |
| bool "Only allow additional certs signed by keys on the builtin trusted keyring" | |
| depends on SECONDARY_TRUSTED_KEYRING | |
| help | |
| If set, only certificates signed by keys on the builtin trusted | |
| keyring may be loaded onto the secondary trusted keyring. | |
| Note: The machine keyring, if configured, will be linked to the | |
| secondary keyring. When enabling this option, it is recommended | |
| to also configure INTEGRITY_CA_MACHINE_KEYRING_MAX to prevent | |
| linking code signing keys with imputed trust to the secondary | |
| trusted keyring. | |
| config SYSTEM_BLACKLIST_KEYRING | |
| bool "Provide system-wide ring of blacklisted keys" | |
| depends on KEYS | |
| help | |
| Provide a system keyring to which blacklisted keys can be added. | |
| Keys in the keyring are considered entirely untrusted. Keys in this | |
| keyring are used by the module signature checking to reject loading | |
| of modules signed with a blacklisted key. | |
| config SYSTEM_BLACKLIST_HASH_LIST | |
| string "Hashes to be preloaded into the system blacklist keyring" | |
| depends on SYSTEM_BLACKLIST_KEYRING | |
| help | |
| If set, this option should be the filename of a list of hashes in the | |
| form "<hash>", "<hash>", ... . This will be included into a C | |
| wrapper to incorporate the list into the kernel. Each <hash> must be a | |
| string starting with a prefix ("tbs" or "bin"), then a colon (":"), and | |
| finally an even number of hexadecimal lowercase characters (up to 128). | |
| Certificate hashes can be generated with | |
| tools/certs/print-cert-tbs-hash.sh . | |
| config SYSTEM_REVOCATION_LIST | |
| bool "Provide system-wide ring of revocation certificates" | |
| depends on SYSTEM_BLACKLIST_KEYRING | |
| depends on PKCS7_MESSAGE_PARSER=y | |
| help | |
| If set, this allows revocation certificates to be stored in the | |
| blacklist keyring and implements a hook whereby a PKCS#7 message can | |
| be checked to see if it matches such a certificate. | |
| config SYSTEM_REVOCATION_KEYS | |
| string "X.509 certificates to be preloaded into the system blacklist keyring" | |
| depends on SYSTEM_REVOCATION_LIST | |
| help | |
| If set, this option should be the filename of a PEM-formatted file | |
| containing X.509 certificates to be included in the default blacklist | |
| keyring. | |
| config SYSTEM_BLACKLIST_AUTH_UPDATE | |
| bool "Allow root to add signed blacklist keys" | |
| depends on SYSTEM_BLACKLIST_KEYRING | |
| depends on SYSTEM_DATA_VERIFICATION | |
| help | |
| If set, provide the ability to load new blacklist keys at run time if | |
| they are signed and vouched by a certificate from the builtin trusted | |
| keyring. The PKCS#7 signature of the description is set in the key | |
| payload. Blacklist keys cannot be removed. | |
| endmenu |