# SPDX-License-Identifier: GPL-2.0-only# IBM Integrity Measurement Architecture#config IMA	bool "Integrity Measurement Architecture(IMA)"	select SECURITYFS	select CRYPTO	select CRYPTO_HMAC	select CRYPTO_SHA1	select CRYPTO_HASH_INFO	select SECURITY_PATH	select TCG_TPM if HAS_IOMEM	select TCG_TIS if TCG_TPM && X86	select TCG_CRB if TCG_TPM && ACPI	select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES	select INTEGRITY_AUDIT if AUDIT	help	  The Trusted Computing Group(TCG) runtime Integrity	  Measurement Architecture(IMA) maintains a list of hash	  values of executables and other sensitive system files,	  as they are read or executed. If an attacker manages	  to change the contents of an important system file	  being measured, we can tell. 	  If your system has a TPM chip, then IMA also maintains	  an aggregate integrity value over this list inside the	  TPM hardware, so that the TPM can prove to a third party	  whether or not critical system files have been modified.	  Read <https://www.usenix.org/events/sec04/tech/sailer.html>	  to learn more about IMA.	  If unsure, say N. if IMA config IMA_KEXEC	bool "Enable carrying the IMA measurement list across a soft boot"	depends on TCG_TPM && HAVE_IMA_KEXEC	default n	help	   TPM PCRs are only reset on a hard reboot.  In order to validate	   a TPM's quote after a soft boot, the IMA measurement list of the	   running kernel must be saved and restored on boot. 	   Depending on the IMA policy, the measurement list can grow to	   be very large. config IMA_MEASURE_PCR_IDX	int	prompt "PCR Index for Aggregate" if EXPERT	range 8 14	default 10	help	  IMA_MEASURE_PCR_IDX determines the TPM PCR register index	  that IMA uses to maintain the integrity aggregate of the	  measurement list. Most attestation tooling expects PCR 10. 	  The default is almost always what you want. Only change this	  if you know what you are doing. config IMA_LSM_RULES	bool	depends on AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR)	default y	help	  Disabling this option will disregard LSM based policy rules. choice	prompt "Default template"	default IMA_NG_TEMPLATE	help	  Select the default IMA measurement template. 	  The original 'ima' measurement list template contains a	  hash, defined as 20 bytes, and a null terminated pathname,	  limited to 255 characters.  The 'ima-ng' measurement list	  template permits both larger hash digests and longer	  pathnames. The configured default template can be replaced	  by specifying "ima_template=" on the boot command line. 	config IMA_NG_TEMPLATE		bool "ima-ng (default)"	config IMA_SIG_TEMPLATE		bool "ima-sig"endchoice config IMA_DEFAULT_TEMPLATE	string	default "ima-ng" if IMA_NG_TEMPLATE	default "ima-sig" if IMA_SIG_TEMPLATE choice	prompt "Default integrity hash algorithm"	default IMA_DEFAULT_HASH_SHA1	help	   Select the default hash algorithm used for the measurement	   list, integrity appraisal and audit log.  The compiled default	   hash algorithm can be overwritten using the kernel command	   line 'ima_hash=' option. 	config IMA_DEFAULT_HASH_SHA1		bool "SHA1 (default)"		depends on CRYPTO_SHA1=y 	config IMA_DEFAULT_HASH_SHA256		bool "SHA256"		depends on CRYPTO_SHA256=y 	config IMA_DEFAULT_HASH_SHA512		bool "SHA512"		depends on CRYPTO_SHA512=y 	config IMA_DEFAULT_HASH_WP512		bool "WP512"		depends on CRYPTO_WP512=y 	config IMA_DEFAULT_HASH_SM3		bool "SM3"		depends on CRYPTO_SM3=yendchoice config IMA_DEFAULT_HASH	string	default "sha1" if IMA_DEFAULT_HASH_SHA1	default "sha256" if IMA_DEFAULT_HASH_SHA256	default "sha512" if IMA_DEFAULT_HASH_SHA512	default "wp512" if IMA_DEFAULT_HASH_WP512	default "sm3" if IMA_DEFAULT_HASH_SM3 config IMA_WRITE_POLICY	bool "Enable multiple writes to the IMA policy"	default n	help	  IMA policy can now be updated multiple times.  The new rules get	  appended to the original policy.  Have in mind that the rules are	  scanned in FIFO order so be careful when you design and add new ones. 	  If unsure, say N. config IMA_READ_POLICY	bool "Enable reading back the current IMA policy"	default y if IMA_WRITE_POLICY	default n if !IMA_WRITE_POLICY	help	   It is often useful to be able to read back the IMA policy.  It is	   even more important after introducing CONFIG_IMA_WRITE_POLICY.	   This option allows the root user to see the current policy rules. config IMA_APPRAISE	bool "Appraise integrity measurements"	default n	help	  This option enables local measurement integrity appraisal.	  It requires the system to be labeled with a security extended	  attribute containing the file hash measurement.  To protect	  the security extended attributes from offline attack, enable	  and configure EVM. 	  For more information on integrity appraisal refer to:	  <http://linux-ima.sourceforge.net>	  If unsure, say N. config IMA_ARCH_POLICY        bool "Enable loading an IMA architecture specific policy"        depends on (KEXEC_SIG && IMA) || IMA_APPRAISE \		   && INTEGRITY_ASYMMETRIC_KEYS        default n        help          This option enables loading an IMA architecture specific policy          based on run time secure boot flags. config IMA_APPRAISE_BUILD_POLICY	bool "IMA build time configured policy rules"	depends on IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS	default n	help	  This option defines an IMA appraisal policy at build time, which	  is enforced at run time without having to specify a builtin	  policy name on the boot command line.  The build time appraisal	  policy rules persist after loading a custom policy. 	  Depending on the rules configured, this policy may require kernel	  modules, firmware, the kexec kernel image, and/or the IMA policy	  to be signed.  Unsigned files might prevent the system from	  booting or applications from working properly. config IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS	bool "Appraise firmware signatures"	depends on IMA_APPRAISE_BUILD_POLICY	default n	help	  This option defines a policy requiring all firmware to be signed,	  including the regulatory.db.  If both this option and	  CFG80211_REQUIRE_SIGNED_REGDB are enabled, then both signature	  verification methods are necessary. config IMA_APPRAISE_REQUIRE_KEXEC_SIGS	bool "Appraise kexec kernel image signatures"	depends on IMA_APPRAISE_BUILD_POLICY	default n	help	  Enabling this rule will require all kexec'ed kernel images to	  be signed and verified by a public key on the trusted IMA	  keyring. 	  Kernel image signatures can not be verified by the original	  kexec_load syscall.  Enabling this rule will prevent its	  usage. config IMA_APPRAISE_REQUIRE_MODULE_SIGS	bool "Appraise kernel modules signatures"	depends on IMA_APPRAISE_BUILD_POLICY	default n	help	  Enabling this rule will require all kernel modules to be signed	  and verified by a public key on the trusted IMA keyring. 	  Kernel module signatures can only be verified by IMA-appraisal,	  via the finit_module syscall. Enabling this rule will prevent	  the usage of the init_module syscall. config IMA_APPRAISE_REQUIRE_POLICY_SIGS	bool "Appraise IMA policy signature"	depends on IMA_APPRAISE_BUILD_POLICY	default n	help	  Enabling this rule will require the IMA policy to be signed and	  and verified by a key on the trusted IMA keyring. config IMA_APPRAISE_BOOTPARAM	bool "ima_appraise boot parameter"	depends on IMA_APPRAISE	default y	help	  This option enables the different "ima_appraise=" modes	  (eg. fix, log) from the boot command line. config IMA_APPRAISE_MODSIG	bool "Support module-style signatures for appraisal"	depends on IMA_APPRAISE	depends on INTEGRITY_ASYMMETRIC_KEYS	select PKCS7_MESSAGE_PARSER	select MODULE_SIG_FORMAT	default n	help	   Adds support for signatures appended to files. The format of the	   appended signature is the same used for signed kernel modules.	   The modsig keyword can be used in the IMA policy to allow a hook	   to accept such signatures. config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY	bool "Permit keys validly signed by a built-in, machine (if configured) or secondary"	depends on SYSTEM_TRUSTED_KEYRING	depends on SECONDARY_TRUSTED_KEYRING	depends on INTEGRITY_ASYMMETRIC_KEYS	select INTEGRITY_TRUSTED_KEYRING	default n	help	  Keys may be added to the IMA or IMA blacklist keyrings, if the	  key is validly signed by a CA cert in the system built-in,	  machine (if configured), or secondary trusted keyrings. The	  key must also have the digitalSignature usage set. 	  Intermediate keys between those the kernel has compiled in and the	  IMA keys to be added may be added to the system secondary keyring,	  provided they are validly signed by a key already resident in the	  built-in, machine (if configured) or secondary trusted keyrings. config IMA_BLACKLIST_KEYRING	bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"	depends on SYSTEM_TRUSTED_KEYRING	depends on INTEGRITY_TRUSTED_KEYRING	default n	help	   This option creates an IMA blacklist keyring, which contains all	   revoked IMA keys.  It is consulted before any other keyring.  If	   the search is successful the requested operation is rejected and	   an error is returned to the caller. config IMA_LOAD_X509	bool "Load X509 certificate onto the '.ima' trusted keyring"	depends on INTEGRITY_TRUSTED_KEYRING	default n	help	   File signature verification is based on the public keys	   loaded on the .ima trusted keyring. These public keys are	   X509 certificates signed by a trusted key on the	   .system keyring.  This option enables X509 certificate	   loading from the kernel onto the '.ima' trusted keyring. config IMA_X509_PATH	string "IMA X509 certificate path"	depends on IMA_LOAD_X509	default "/etc/keys/x509_ima.der"	help	   This option defines IMA X509 certificate path. config IMA_APPRAISE_SIGNED_INIT	bool "Require signed user-space initialization"	depends on IMA_LOAD_X509	default n	help	   This option requires user-space init to be signed. config IMA_MEASURE_ASYMMETRIC_KEYS	bool	depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y	default y config IMA_QUEUE_EARLY_BOOT_KEYS	bool	depends on IMA_MEASURE_ASYMMETRIC_KEYS	depends on SYSTEM_TRUSTED_KEYRING	default y config IMA_SECURE_AND_OR_TRUSTED_BOOT       bool       depends on IMA_ARCH_POLICY       help          This option is selected by architectures to enable secure and/or          trusted boot based on IMA runtime policies. config IMA_DISABLE_HTABLE	bool "Disable htable to allow measurement of duplicate records"	default n	help	   This option disables htable to allow measurement of duplicate records. config IMA_KEXEC_EXTRA_MEMORY_KB	int "Extra memory for IMA measurements added during kexec soft reboot"	range 0 40	depends on IMA_KEXEC	default 0	help	  IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be	  allocated (in kb) for IMA measurements added during kexec soft reboot.	  If set to the default value of 0, an extra half page of memory for those	  additional measurements will be allocated. config IMA_STAGING	bool "Support for staging the measurements list"	default n	help	  Add support for staging the measurements list. 	  It allows user space to stage the measurements list for deletion and	  to delete the staged measurements after confirmation. 	  Or, alternatively, it allows user space to specify N measurements	  records to stage internally, so that they can be immediately deleted. 	  On kexec, staging is aborted and any staged measurement records are	  copied to the secondary kernel. config IMA_INIT_LATE_SYNC	bool "Initialise IMA at late_initcall_sync"	default n	help	  This option initialises IMA at late_initcall_sync for platforms	  where TPM device probing is deferred.	  When this option is enabled, modules that access files in the	  initramfs through usermode helper calls such as request_module()	  during initcall must not be built-in. Otherwise, IMA may miss	  file measurements for them.endif