Changes in Kconfig

a19bcde4 - Revert "fsverity: relax build time dependency on CRYPTO_SHA256"

Mon, 17 Feb 2025 18:51:05 +0000

Revert "fsverity: relax build time dependency on CRYPTO_SHA256"This reverts commit e3a606f2c544b231f6079c8c5fea451e772e1139 because itallows people to create broken configurations that enable FS_VERITY butnot SHA-256 support.The commit did allow people to disable the generic SHA-256implementation when it's not needed. But that at best allowed saving abit of code. In the real world people are unlikely to intentionally andcorrectly make such a tweak anyway, as they tend to just be confused bywhat all the different crypto kconfig options mean.Of course we really need the crypto API to enable the correctimplementations automatically, but that's for a later fix.Acked-by: Ard Biesheuvel Cc: Herbert Xu Link: https://lore.kernel.org/r/20250217185105.26751-1-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux-6.15/fs/verity/Kconfig

672d6ef4 - fsverity: improve documentation for builtin signature support

Tue, 20 Jun 2023 04:19:37 +0000

fsverity: improve documentation for builtin signature supportfsverity builtin signatures (CONFIG_FS_VERITY_BUILTIN_SIGNATURES) aren'tthe only way to do signatures with fsverity, and they have some majorlimitations. Yet, more users have tried to use them, e.g. recently byhttps://github.com/ostreedev/ostree/pull/2640. In most cases this seemsto be because users aren't sufficiently familiar with the limitations ofthis feature and what the alternatives are.Therefore, make some updates to the documentation to try to clarify theproperties of this feature and nudge users in the right direction.Note that the Integrity Policy Enforcement (IPE) LSM, which is not yetupstream, is planned to use the builtin signatures. (This differs fromIMA, which uses its own signature mechanism.) For that reason, myearlier patch "fsverity: mark builtin signatures as deprecated"(https://lore.kernel.org/r/20221208033548.122704-1-ebiggers@kernel.org),which marked builtin signatures as "deprecated", was controversial.This patch therefore stops short of marking the feature as deprecated.I've also revised the language to focus on better explaining the featureand what its alternatives are.Link: https://lore.kernel.org/r/20230620041937.5809-1-ebiggers@kernel.orgReviewed-by: Colin Walters Reviewed-by: Luca Boccassi Signed-off-by: Eric Biggers List of files: /linux-6.15/fs/verity/Kconfig

86f66569 - fsverity: remove debug messages and CONFIG_FS_VERITY_DEBUG

Thu, 15 Dec 2022 06:04:20 +0000

fsverity: remove debug messages and CONFIG_FS_VERITY_DEBUGI've gotten very little use out of these debug messages, and I'm notaware of anyone else having used them.Indeed, sprinkling pr_debug around is not really a best practice thesedays, especially for filesystem code. Tracepoints are used instead.Let's just remove these and start from a clean slate.This change does not affect info, warning, and error messages.Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20221215060420.60692-1-ebiggers@kernel.org List of files: /linux-6.15/fs/verity/Kconfig

8da572c5 - fs-verity: mention btrfs support

Fri, 10 Jun 2022 00:06:16 +0000

fs-verity: mention btrfs supportbtrfs supports fs-verity since Linux v5.15. Document this.Signed-off-by: Eric Biggers Acked-by: David Sterba Link: https://lore.kernel.org/r/20220610000616.18225-1-ebiggers@kernel.org List of files: /linux-6.15/fs/verity/Kconfig

246d9216 - fs-verity: define a function to return the integrity protected file digest

Tue, 23 Nov 2021 18:37:52 +0000

fs-verity: define a function to return the integrity protected file digestDefine a function named fsverity_get_digest() to return the verity filedigest and the associated hash algorithm (enum hash_algo).This assumes that before calling fsverity_get_digest() the file must havebeen opened, which is even true for the IMA measure/appraise on fileopen policy rule use case (func=FILE_CHECK). do_open() calls vfs_open()immediately prior to ima_file_check().Acked-by: Eric Biggers Signed-off-by: Mimi Zohar List of files: /linux-6.15/fs/verity/Kconfig

e3a606f2 - fsverity: relax build time dependency on CRYPTO_SHA256

Wed, 21 Apr 2021 07:55:11 +0000

fsverity: relax build time dependency on CRYPTO_SHA256CONFIG_CRYPTO_SHA256 denotes the generic C implementation of the SHA-256shash algorithm, which is selected as the default crypto shash providerfor fsverity. However, fsverity has no strict link time dependency, andthe same shash could be exposed by an optimized implementation, and arm64has a number of those (scalar, NEON-based and one based on special cryptoinstructions). In such cases, it makes little sense to require that thegeneric C implementation is incorporated as well, given that it will neverbe called.To address this, relax the 'select' clause to 'imply' so that the genericdriver can be omitted from the build if desired.Acked-by: Eric Biggers Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/fs/verity/Kconfig

432434c9 - fs-verity: support builtin file signatures

Mon, 22 Jul 2019 16:26:23 +0000

fs-verity: support builtin file signaturesTo meet some users' needs, add optional support for having fs-verityhandle a portion of the authentication policy in the kernel. An".fs-verity" keyring is created to which X.509 certificates can beadded; then a sysctl 'fs.verity.require_signatures' can be set to causethe kernel to enforce that all fs-verity files contain a signature oftheir file measurement by a key in this keyring.See the "Built-in signature verification" section ofDocumentation/filesystems/fsverity.rst for the full documentation.Reviewed-by: Theodore Ts'o Signed-off-by: Eric Biggers List of files: /linux-6.15/fs/verity/Kconfig

671e67b4 - fs-verity: add Kconfig and the helper functions for hashing

Mon, 22 Jul 2019 16:26:21 +0000

fs-verity: add Kconfig and the helper functions for hashingAdd the beginnings of the fs/verity/ support layer, including theKconfig option and various helper functions for hashing. To start, onlySHA-256 is supported, but other hash algorithms can easily be added.Reviewed-by: Theodore Ts'o Reviewed-by: Jaegeuk Kim Signed-off-by: Eric Biggers List of files: /linux-6.15/fs/verity/Kconfig