diff options
| author | Deven Bowers <deven.desai@linux.microsoft.com> | 2024-08-02 23:08:31 -0700 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 14:03:39 -0400 |
| commit | ba199dc909a20fe62270ae4e93f263987bb9d119 (patch) | |
| tree | 497a4893e9b186438a37fbcab53cb1900480065f /security/ipe/Kconfig | |
| parent | 31f8c8682f30720be25e9b1021caa43c64e8d9ce (diff) | |
scripts: add boot policy generation program
Enables an IPE policy to be enforced from kernel start, enabling access
control based on trust from kernel startup. This is accomplished by
transforming an IPE policy indicated by CONFIG_IPE_BOOT_POLICY into a
c-string literal that is parsed at kernel startup as an unsigned policy.
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/ipe/Kconfig')
| -rw-r--r-- | security/ipe/Kconfig | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/security/ipe/Kconfig b/security/ipe/Kconfig index 6bc487b689e0..fccc69e66af1 100644 --- a/security/ipe/Kconfig +++ b/security/ipe/Kconfig @@ -21,6 +21,16 @@ menuconfig SECURITY_IPE If unsure, answer N. if SECURITY_IPE +config IPE_BOOT_POLICY + string "Integrity policy to apply on system startup" + help + This option specifies a filepath to an IPE policy that is compiled + into the kernel. This policy will be enforced until a policy update + is deployed via the $securityfs/ipe/policies/$policy_name/active + interface. + + If unsure, leave blank. + menu "IPE Trust Providers" config IPE_PROP_DM_VERITY |