0001 # SPDX-License-Identifier: GPL-2.0
0002
0003 config FS_VERITY
0004 bool "FS Verity (read-only file-based authenticity protection)"
0005 select CRYPTO
0006 select CRYPTO_HASH_INFO
0007 # SHA-256 is implied as it's intended to be the default hash algorithm.
0008 # To avoid bloat, other wanted algorithms must be selected explicitly.
0009 # Note that CRYPTO_SHA256 denotes the generic C implementation, but
0010 # some architectures provided optimized implementations of the same
0011 # algorithm that may be used instead. In this case, CRYPTO_SHA256 may
0012 # be omitted even if SHA-256 is being used.
0013 imply CRYPTO_SHA256
0014 help
0015 This option enables fs-verity. fs-verity is the dm-verity
0016 mechanism implemented at the file level. On supported
0017 filesystems (currently ext4, f2fs, and btrfs), userspace can
0018 use an ioctl to enable verity for a file, which causes the
0019 filesystem to build a Merkle tree for the file. The filesystem
0020 will then transparently verify any data read from the file
0021 against the Merkle tree. The file is also made read-only.
0022
0023 This serves as an integrity check, but the availability of the
0024 Merkle tree root hash also allows efficiently supporting
0025 various use cases where normally the whole file would need to
0026 be hashed at once, such as: (a) auditing (logging the file's
0027 hash), or (b) authenticity verification (comparing the hash
0028 against a known good value, e.g. from a digital signature).
0029
0030 fs-verity is especially useful on large files where not all
0031 the contents may actually be needed. Also, fs-verity verifies
0032 data each time it is paged back in, which provides better
0033 protection against malicious disks vs. an ahead-of-time hash.
0034
0035 If unsure, say N.
0036
0037 config FS_VERITY_DEBUG
0038 bool "FS Verity debugging"
0039 depends on FS_VERITY
0040 help
0041 Enable debugging messages related to fs-verity by default.
0042
0043 Say N unless you are an fs-verity developer.
0044
0045 config FS_VERITY_BUILTIN_SIGNATURES
0046 bool "FS Verity builtin signature support"
0047 depends on FS_VERITY
0048 select SYSTEM_DATA_VERIFICATION
0049 help
0050 Support verifying signatures of verity files against the X.509
0051 certificates that have been loaded into the ".fs-verity"
0052 kernel keyring.
0053
0054 This is meant as a relatively simple mechanism that can be
0055 used to provide an authenticity guarantee for verity files, as
0056 an alternative to IMA appraisal. Userspace programs still
0057 need to check that the verity bit is set in order to get an
0058 authenticity guarantee.
0059
0060 If unsure, say N.
