# SPDX-License-Identifier: GPL-2.0-only## Integrity Policy Enforcement (IPE) configuration# menuconfig SECURITY_IPE	bool "Integrity Policy Enforcement (IPE)"	depends on SECURITY && SECURITYFS && AUDIT && AUDITSYSCALL	select CRYPTO_LIB_SHA256	select PKCS7_MESSAGE_PARSER	select SYSTEM_DATA_VERIFICATION	select IPE_PROP_DM_VERITY if DM_VERITY	select IPE_PROP_DM_VERITY_SIGNATURE if DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG	select IPE_PROP_FS_VERITY if FS_VERITY	select IPE_PROP_FS_VERITY_BUILTIN_SIG if FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES	help	  This option enables the Integrity Policy Enforcement LSM	  allowing users to define a policy to enforce a trust-based access	  control. A key feature of IPE is a customizable policy to allow	  admins to reconfigure trust requirements on the fly. 	  If unsure, answer N. if SECURITY_IPEconfig IPE_BOOT_POLICY	string "Integrity policy to apply on system startup"	help	  This option specifies a filepath to an IPE policy that is compiled	  into the kernel. This policy will be enforced until a policy update	  is deployed via the $securityfs/ipe/policies/$policy_name/active	  interface. 	  If unsure, leave blank. config IPE_POLICY_SIG_SECONDARY_KEYRING	bool "IPE policy update verification with secondary keyring"	default y	depends on SECONDARY_TRUSTED_KEYRING	help	  Also allow the secondary trusted keyring to verify IPE policy	  updates. 	  If unsure, answer Y. config IPE_POLICY_SIG_PLATFORM_KEYRING	bool "IPE policy update verification with platform keyring"	default y	depends on INTEGRITY_PLATFORM_KEYRING	help	  Also allow the platform keyring to verify IPE policy updates. 	  If unsure, answer Y. menu "IPE Trust Providers" config IPE_PROP_DM_VERITY	bool "Enable support for dm-verity based on root hash"	depends on DM_VERITY	help	  This option enables the 'dmverity_roothash' property within IPE	  policies. The property evaluates to TRUE when a file from a dm-verity	  volume is evaluated, and the volume's root hash matches the value	  supplied in the policy. config IPE_PROP_DM_VERITY_SIGNATURE	bool "Enable support for dm-verity based on root hash signature"	depends on DM_VERITY && DM_VERITY_VERIFY_ROOTHASH_SIG	help	  This option enables the 'dmverity_signature' property within IPE	  policies. The property evaluates to TRUE when a file from a dm-verity	  volume, which has been mounted with a valid signed root hash,	  is evaluated. 	  If unsure, answer Y. config IPE_PROP_FS_VERITY	bool "Enable support for fs-verity based on file digest"	depends on FS_VERITY	help	  This option enables the 'fsverity_digest' property within IPE	  policies. The property evaluates to TRUE when a file is fsverity	  enabled and its digest matches the supplied digest value in the	  policy. 	  if unsure, answer Y. config IPE_PROP_FS_VERITY_BUILTIN_SIG	bool "Enable support for fs-verity based on builtin signature"	depends on FS_VERITY && FS_VERITY_BUILTIN_SIGNATURES	help	  This option enables the 'fsverity_signature' property within IPE	  policies. The property evaluates to TRUE when a file is fsverity	  enabled and it has a valid builtin signature whose signing cert	  is in the .fs-verity keyring. 	  if unsure, answer Y. endmenu config SECURITY_IPE_KUNIT_TEST	bool "Build KUnit tests for IPE" if !KUNIT_ALL_TESTS	depends on KUNIT=y	default KUNIT_ALL_TESTS	help	  This builds the IPE KUnit tests. 	  KUnit tests run during boot and output the results to the debug log	  in TAP format (https://testanything.org/). Only useful for kernel devs	  running KUnit test harness and are not for inclusion into a	  production build. 	  For more information on KUnit and unit tests in general please refer	  to the KUnit documentation in Documentation/dev-tools/kunit/. 	  If unsure, say N. endif