Changes in Kconfig

7b5c3086 - integrity: fix indentation of config attributes

Sun, 22 Oct 2023 06:47:23 +0000

integrity: fix indentation of config attributesFix indentation of config attributes. Attributes are generallyindented with a leading tab(\t) character.Signed-off-by: Prasad Pandit Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig

3edc2265 - integrity: powerpc: Do not select CA_MACHINE_KEYRING

Thu, 07 Sep 2023 16:52:19 +0000

integrity: powerpc: Do not select CA_MACHINE_KEYRINGNo other platform needs CA_MACHINE_KEYRING, either.This is policy that should be decided by the administrator, not Kconfigdependencies.Cc: stable@vger.kernel.org # v6.6+Fixes: d7d91c4743c4 ("integrity: PowerVM machine keyring enablement")Signed-off-by: Michal Suchanek Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/Kconfig

d7d91c47 - integrity: PowerVM machine keyring enablement

Tue, 15 Aug 2023 11:27:21 +0000

integrity: PowerVM machine keyring enablementUpdate Kconfig to enable machine keyring and limit to CA certificateson PowerVM. Only key signing CA keys are allowed.Signed-off-by: Nayna Jain Reviewed-and-tested-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Nageswara R Sastry Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/Kconfig

099f26f2 - integrity: machine keyring CA configuration

Thu, 02 Mar 2023 16:46:52 +0000

integrity: machine keyring CA configurationAdd machine keyring CA restriction options to control the type ofkeys that may be added to it. The motivation is separation ofcertificate signing from code signing keys. Subsquent work willlimit certificates being loaded into the IMA keyring to codesigning keys used for signature verification.When no restrictions are selected, all Machine Owner Keys (MOK) are addedto the machine keyring. When CONFIG_INTEGRITY_CA_MACHINE_KEYRING isselected, the CA bit must be true. Also the key usage must containkeyCertSign, any other usage field may be set as well.When CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX is selected, the CA bit mustbe true. Also the key usage must contain keyCertSign and thedigitialSignature usage may not be set.Signed-off-by: Eric Snowberg Acked-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/Kconfig

d1996776 - integrity: Introduce a Linux keyring called machine

Wed, 26 Jan 2022 02:58:28 +0000

integrity: Introduce a Linux keyring called machineMany UEFI Linux distributions boot using shim. The UEFI shim provideswhat is called Machine Owner Keys (MOK). Shim uses both the UEFI SecureBoot DB and MOK keys to validate the next step in the boot chain. TheMOK facility can be used to import user generated keys. These keys canbe used to sign an end-users development kernel build. When Linuxboots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux.platform keyring.Define a new Linux keyring called machine. This keyring shall contain justMOK keys and not the remaining keys in the platform keyring. This newmachine keyring will be used in follow on patches. Unlike keys in theplatform keyring, keys contained in the machine keyring will be trustedwithin the kernel if the end-user has chosen to do so.Signed-off-by: Eric Snowberg Tested-by: Jarkko Sakkinen Tested-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/Kconfig

8220e22d - powerpc: Load firmware trusted keys/hashes into kernel keyring

Mon, 11 Nov 2019 03:10:36 +0000

powerpc: Load firmware trusted keys/hashes into kernel keyringThe keys used to verify the Host OS kernel are managed by firmware assecure variables. This patch loads the verification keys into the.platform keyring and revocation hashes into .blacklist keyring. Thisenables verification and loading of the kernels signed by the boottime keys which are trusted by firmware.Signed-off-by: Nayna Jain Reviewed-by: Mimi Zohar Signed-off-by: Eric Richter [mpe: Search by compatible in load_powerpc_certs(), not using format]Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1573441836-3632-5-git-send-email-nayna@linux.ibm.com List of files: /linux-6.15/security/integrity/Kconfig

cf38fed1 - integrity: Select CONFIG_KEYS instead of depending on it

Fri, 28 Jun 2019 02:19:27 +0000

integrity: Select CONFIG_KEYS instead of depending on itThis avoids a dependency cycle in soon-to-be-introducedCONFIG_IMA_APPRAISE_MODSIG: it will select CONFIG_MODULE_SIG_FORMATwhich in turn selects CONFIG_KEYS. Kconfig then complains thatCONFIG_INTEGRITY_SIGNATURE depends on CONFIG_KEYS.Signed-off-by: Thiago Jung Bauermann Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/integrity/Kconfig

9641b8cc - s390/ipl: read IPL report at early boot

Thu, 21 Feb 2019 13:23:04 +0000

s390/ipl: read IPL report at early bootRead the IPL Report block provided by secure-boot, add the entriesof the certificate list to the system key ring and print the listof components.PR: Adjust to Vasilys bootdata_preserved patch set. Preserve ipl_cert_listfor later use in kexec_file.Signed-off-by: Martin Schwidefsky Signed-off-by: Philipp Rudo Signed-off-by: Martin Schwidefsky List of files: /linux-6.15/security/integrity/Kconfig

8636a1f9 - treewide: surround Kconfig file paths with double quotes

Tue, 11 Dec 2018 11:01:04 +0000

treewide: surround Kconfig file paths with double quotesThe Kconfig lexer supports special characters such as '.' and '/' inthe parameter context. In my understanding, the reason is just tosupport bare file paths in the source statement.I do not see a good reason to complicate Kconfig for the room ofambiguity.The majority of code already surrounds file paths with double quotes,and it makes sense since file paths are constant string literals.Make it treewide consistent now.Signed-off-by: Masahiro Yamada Acked-by: Wolfram Sang Acked-by: Geert Uytterhoeven Acked-by: Ingo Molnar List of files: /linux-6.15/security/integrity/Kconfig

9dc92c45 - integrity: Define a trusted platform keyring

Sat, 08 Dec 2018 20:26:59 +0000

integrity: Define a trusted platform keyringOn secure boot enabled systems, a verified kernel may need to kexecadditional kernels. For example, it may be used as a bootloader needingto kexec a target kernel or it may need to kexec a crashdump kernel. Insuch cases, it may want to verify the signature of the next kernelimage.It is further possible that the kernel image is signed with third partykeys which are stored as platform or firmware keys in the 'db' variable.The kernel, however, can not directly verify these platform keys, and anadministrator may therefore not want to trust them for arbitrary usage.In order to differentiate platform keys from other keys and provide thenecessary separation of trust, the kernel needs an additional keyring tostore platform keys.This patch creates the new keyring called ".platform" to isolate keysprovided by platform from keys by kernel. These keys are used tofacilitate signature verification during kexec. Since the scope of thiskeyring is only the platform/firmware keys, it cannot be updated fromuserspace.This keyring can be enabled by setting CONFIG_INTEGRITY_PLATFORM_KEYRING.Signed-off-by: Nayna Jain Reviewed-by: Mimi Zohar Acked-by: Serge Hallyn Reviewed-by: James Morris Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig

93da17b1 - security: integrity: Remove select to deleted option PUBLIC_KEY_ALGO_RSA

Tue, 12 Apr 2016 18:54:58 +0000

security: integrity: Remove select to deleted option PUBLIC_KEY_ALGO_RSACommit d43de6c780a8 ("akcipher: Move the RSA DER encoding check tothe crypto layer") removed the Kconfig option PUBLIC_KEY_ALGO_RSA,but forgot to remove a 'select' to this option in the definition ofINTEGRITY_ASYMMETRIC_KEYS.Let's remove the select, as it's ineffective now.Signed-off-by: Andreas Ziegler Signed-off-by: David Howells List of files: /linux-6.15/security/integrity/Kconfig

eb5798f2 - integrity: convert digsig to akcipher api

Tue, 02 Feb 2016 18:08:58 +0000

integrity: convert digsig to akcipher apiConvert asymmetric_verify to akcipher api.Signed-off-by: Tadeusz Struk Acked-by: Herbert Xu Signed-off-by: David Howells List of files: /linux-6.15/security/integrity/Kconfig

50d35015 - KEYS: CONFIG_KEYS_DEBUG_PROC_KEYS is no longer an option

Wed, 03 Feb 2016 15:04:40 +0000

KEYS: CONFIG_KEYS_DEBUG_PROC_KEYS is no longer an optionCONFIG_KEYS_DEBUG_PROC_KEYS is no longer an option as /proc/keys is nowmandatory if the keyrings facility is enabled (it's used by libkeyutils inuserspace).The defconfig references were removed with: perl -p -i -e 's/CONFIG_KEYS_DEBUG_PROC_KEYS=y\n//' \ `git grep -l CONFIG_KEYS_DEBUG_PROC_KEYS=y`and the integrity Kconfig fixed by hand.Signed-off-by: David Howells cc: Andreas Ziegler cc: Dmitry Kasatkin List of files: /linux-6.15/security/integrity/Kconfig

f75516a8 - crypto: keys - Revert "convert public key to akcipher api"

Tue, 09 Feb 2016 08:18:01 +0000

crypto: keys - Revert "convert public key to akcipher api"This needs to go through the security tree so I'm reverting thepatches for now.Signed-off-by: Herbert Xu List of files: /linux-6.15/security/integrity/Kconfig

42bbaabb - integrity: convert digsig to akcipher api

Tue, 02 Feb 2016 18:08:58 +0000

integrity: convert digsig to akcipher apiConvert asymmetric_verify to akcipher api.Signed-off-by: Tadeusz Struk Signed-off-by: Herbert Xu List of files: /linux-6.15/security/integrity/Kconfig

f4dc3778 - integrity: define '.evm' as a builtin 'trusted' keyring

Thu, 22 Oct 2015 18:26:10 +0000

integrity: define '.evm' as a builtin 'trusted' keyringRequire all keys added to the EVM keyring be signed by anexisting trusted key on the system trusted keyring.This patch also switches IMA to use integrity_init_keyring().Changes in v3:* Added 'init_keyring' config based variable to skip initializing keyring instead of using __integrity_init_keyring() wrapper.* Added dependency back to CONFIG_IMA_TRUSTED_KEYRINGChanges in v2:* Replace CONFIG_EVM_TRUSTED_KEYRING with IMA and EVM common CONFIG_INTEGRITY_TRUSTED_KEYRING configuration option* Deprecate CONFIG_IMA_TRUSTED_KEYRING but keep it for config file compatibility. (Mimi Zohar)Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig

6341e62b - kconfig: use bool instead of boolean for type definition attributes

Sat, 20 Dec 2014 20:41:11 +0000

kconfig: use bool instead of boolean for type definition attributesSupport for keyword 'boolean' will be dropped later on.No functional change.Reference: http://lkml.kernel.org/r/cover.1418003065.git.cj@linux.comSigned-off-by: Christoph Jaeger Signed-off-by: Michal Marek List of files: /linux-6.15/security/integrity/Kconfig

7ef84e65 - integrity: base integrity subsystem kconfig options on integrity

Thu, 17 Apr 2014 12:07:15 +0000

integrity: base integrity subsystem kconfig options on integrityThe integrity subsystem has lots of options and takes more thanhalf of the security menu. This patch consolidates the optionsunder "integrity", which are hidden if not enabled. This changedoes not affect existing configurations. Re-configuration is notneeded.Changes v4:- no need to change "integrity subsystem" to menuconfig asoptions are hidden, when not enabled. (Mimi)- add INTEGRITY Kconfig help descriptionChanges v3:- dependency to INTEGRITY removed when behind 'if INTEGRITY'Changes v2:- previous patch moved integrity out of the 'security' menu. This version keeps integrity as a security option (Mimi).Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig

1ae8f41c - integrity: move asymmetric keys config option

Thu, 17 Apr 2014 11:41:06 +0000

integrity: move asymmetric keys config optionFor better visual appearance it is better to co-locateasymmetric key options together with signature support.Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar List of files: /linux-6.15/security/integrity/Kconfig