mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-21 03:33:59 +08:00
d3bfe84129
Add a secondary system keyring that can be added to by root whilst the system is running - provided the key being added is vouched for by a key built into the kernel or already added to the secondary keyring. Rename .system_keyring to .builtin_trusted_keys to distinguish it more obviously from the new keyring (called .secondary_trusted_keys). The new keyring needs to be enabled with CONFIG_SECONDARY_TRUSTED_KEYRING. If the secondary keyring is enabled, a link is created from that to .builtin_trusted_keys so that the the latter will automatically be searched too if the secondary keyring is searched. Signed-off-by: David Howells <dhowells@redhat.com>
68 lines
2.6 KiB
Plaintext
68 lines
2.6 KiB
Plaintext
menu "Certificates for signature checking"
|
|
|
|
config MODULE_SIG_KEY
|
|
string "File name or PKCS#11 URI of module signing key"
|
|
default "certs/signing_key.pem"
|
|
depends on MODULE_SIG
|
|
help
|
|
Provide the file name of a private key/certificate in PEM format,
|
|
or a PKCS#11 URI according to RFC7512. The file should contain, or
|
|
the URI should identify, both the certificate and its corresponding
|
|
private key.
|
|
|
|
If this option is unchanged from its default "certs/signing_key.pem",
|
|
then the kernel will automatically generate the private key and
|
|
certificate as described in Documentation/module-signing.txt
|
|
|
|
config SYSTEM_TRUSTED_KEYRING
|
|
bool "Provide system-wide ring of trusted keys"
|
|
depends on KEYS
|
|
depends on ASYMMETRIC_KEY_TYPE
|
|
help
|
|
Provide a system keyring to which trusted keys can be added. Keys in
|
|
the keyring are considered to be trusted. Keys may be added at will
|
|
by the kernel from compiled-in data and from hardware key stores, but
|
|
userspace may only add extra keys if those keys can be verified by
|
|
keys already in the keyring.
|
|
|
|
Keys in this keyring are used by module signature checking.
|
|
|
|
config SYSTEM_TRUSTED_KEYS
|
|
string "Additional X.509 keys for default system keyring"
|
|
depends on SYSTEM_TRUSTED_KEYRING
|
|
help
|
|
If set, this option should be the filename of a PEM-formatted file
|
|
containing trusted X.509 certificates to be included in the default
|
|
system keyring. Any certificate used for module signing is implicitly
|
|
also trusted.
|
|
|
|
NOTE: If you previously provided keys for the system keyring in the
|
|
form of DER-encoded *.x509 files in the top-level build directory,
|
|
those are no longer used. You will need to set this option instead.
|
|
|
|
config SYSTEM_EXTRA_CERTIFICATE
|
|
bool "Reserve area for inserting a certificate without recompiling"
|
|
depends on SYSTEM_TRUSTED_KEYRING
|
|
help
|
|
If set, space for an extra certificate will be reserved in the kernel
|
|
image. This allows introducing a trusted certificate to the default
|
|
system keyring without recompiling the kernel.
|
|
|
|
config SYSTEM_EXTRA_CERTIFICATE_SIZE
|
|
int "Number of bytes to reserve for the extra certificate"
|
|
depends on SYSTEM_EXTRA_CERTIFICATE
|
|
default 4096
|
|
help
|
|
This is the number of bytes reserved in the kernel image for a
|
|
certificate to be inserted.
|
|
|
|
config SECONDARY_TRUSTED_KEYRING
|
|
bool "Provide a keyring to which extra trustable keys may be added"
|
|
depends on SYSTEM_TRUSTED_KEYRING
|
|
help
|
|
If set, provide a keyring to which extra keys may be added, provided
|
|
those keys are not blacklisted and are vouched for by a key built
|
|
into the kernel or already in the secondary trusted keyring.
|
|
|
|
endmenu
|