Commit | Line | Data |
---|---|---|
f0894940 DH |
1 | # |
2 | # Key management configuration | |
3 | # | |
4 | ||
5 | config KEYS | |
6 | bool "Enable access key retention support" | |
7 | help | |
8 | This option provides support for retaining authentication tokens and | |
9 | access keys in the kernel. | |
10 | ||
11 | It also includes provision of methods by which such keys might be | |
12 | associated with a process so that network filesystems, encryption | |
13 | support and the like can find them. | |
14 | ||
15 | Furthermore, a special type of key is available that acts as keyring: | |
16 | a searchable sequence of keys. Each process is equipped with access | |
17 | to five standard keyrings: UID-specific, GID-specific, session, | |
18 | process and thread. | |
19 | ||
20 | If you are unsure as to whether this is required, answer N. | |
21 | ||
22 | config TRUSTED_KEYS | |
23 | tristate "TRUSTED KEYS" | |
24 | depends on KEYS && TCG_TPM | |
25 | select CRYPTO | |
26 | select CRYPTO_HMAC | |
27 | select CRYPTO_SHA1 | |
28 | help | |
29 | This option provides support for creating, sealing, and unsealing | |
30 | keys in the kernel. Trusted keys are random number symmetric keys, | |
31 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, | |
32 | if the boot PCRs and other criteria match. Userspace will only ever | |
33 | see encrypted blobs. | |
34 | ||
35 | If you are unsure as to whether this is required, answer N. | |
36 | ||
37 | config ENCRYPTED_KEYS | |
38 | tristate "ENCRYPTED KEYS" | |
39 | depends on KEYS | |
40 | select CRYPTO | |
41 | select CRYPTO_HMAC | |
42 | select CRYPTO_AES | |
43 | select CRYPTO_CBC | |
44 | select CRYPTO_SHA256 | |
45 | select CRYPTO_RNG | |
46 | help | |
47 | This option provides support for create/encrypting/decrypting keys | |
48 | in the kernel. Encrypted keys are kernel generated random numbers, | |
49 | which are encrypted/decrypted with a 'master' symmetric key. The | |
50 | 'master' key can be either a trusted-key or user-key type. | |
51 | Userspace only ever sees/stores encrypted blobs. | |
52 | ||
53 | If you are unsure as to whether this is required, answer N. | |
54 | ||
55 | config KEYS_DEBUG_PROC_KEYS | |
56 | bool "Enable the /proc/keys file by which keys may be viewed" | |
57 | depends on KEYS | |
58 | help | |
59 | This option turns on support for the /proc/keys file - through which | |
60 | can be listed all the keys on the system that are viewable by the | |
61 | reading process. | |
62 | ||
63 | The only keys included in the list are those that grant View | |
64 | permission to the reading process whether or not it possesses them. | |
65 | Note that LSM security checks are still performed, and may further | |
66 | filter out keys that the current process is not authorised to view. | |
67 | ||
68 | Only key attributes are listed here; key payloads are not included in | |
69 | the resulting table. | |
70 | ||
71 | If you are unsure as to whether this is required, answer N. |