3cd18d1981
The recent rework introduced a possible randconfig build failure
when CONFIG_CRYPTO configured to only allow modules:
security/keys/big_key.o: In function `big_key_crypt':
big_key.c:(.text+0x29f): undefined reference to `crypto_aead_setkey'
security/keys/big_key.o: In function `big_key_init':
big_key.c:(.init.text+0x1a): undefined reference to `crypto_alloc_aead'
big_key.c:(.init.text+0x45): undefined reference to `crypto_aead_setauthsize'
big_key.c:(.init.text+0x77): undefined reference to `crypto_destroy_tfm'
crypto/gcm.o: In function `gcm_hash_crypt_remain_continue':
gcm.c:(.text+0x167): undefined reference to `crypto_ahash_finup'
crypto/gcm.o: In function `crypto_gcm_exit_tfm':
gcm.c:(.text+0x847): undefined reference to `crypto_destroy_tfm'
When we 'select CRYPTO' like the other users, we always get a
configuration that builds.
Fixes: 428490e38b ("security/keys: rewrite all of big_key crypto")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David Howells <dhowells@redhat.com>
104 lines
3.3 KiB
Plaintext
104 lines
3.3 KiB
Plaintext
#
|
|
# Key management configuration
|
|
#
|
|
|
|
config KEYS
|
|
bool "Enable access key retention support"
|
|
select ASSOCIATIVE_ARRAY
|
|
help
|
|
This option provides support for retaining authentication tokens and
|
|
access keys in the kernel.
|
|
|
|
It also includes provision of methods by which such keys might be
|
|
associated with a process so that network filesystems, encryption
|
|
support and the like can find them.
|
|
|
|
Furthermore, a special type of key is available that acts as keyring:
|
|
a searchable sequence of keys. Each process is equipped with access
|
|
to five standard keyrings: UID-specific, GID-specific, session,
|
|
process and thread.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
config KEYS_COMPAT
|
|
def_bool y
|
|
depends on COMPAT && KEYS
|
|
|
|
config PERSISTENT_KEYRINGS
|
|
bool "Enable register of persistent per-UID keyrings"
|
|
depends on KEYS
|
|
help
|
|
This option provides a register of persistent per-UID keyrings,
|
|
primarily aimed at Kerberos key storage. The keyrings are persistent
|
|
in the sense that they stay around after all processes of that UID
|
|
have exited, not that they survive the machine being rebooted.
|
|
|
|
A particular keyring may be accessed by either the user whose keyring
|
|
it is or by a process with administrative privileges. The active
|
|
LSMs gets to rule on which admin-level processes get to access the
|
|
cache.
|
|
|
|
Keyrings are created and added into the register upon demand and get
|
|
removed if they expire (a default timeout is set upon creation).
|
|
|
|
config BIG_KEYS
|
|
bool "Large payload keys"
|
|
depends on KEYS
|
|
depends on TMPFS
|
|
select CRYPTO
|
|
select CRYPTO_AES
|
|
select CRYPTO_GCM
|
|
help
|
|
This option provides support for holding large keys within the kernel
|
|
(for example Kerberos ticket caches). The data may be stored out to
|
|
swapspace by tmpfs.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
config TRUSTED_KEYS
|
|
tristate "TRUSTED KEYS"
|
|
depends on KEYS && TCG_TPM
|
|
select CRYPTO
|
|
select CRYPTO_HMAC
|
|
select CRYPTO_SHA1
|
|
select CRYPTO_HASH_INFO
|
|
help
|
|
This option provides support for creating, sealing, and unsealing
|
|
keys in the kernel. Trusted keys are random number symmetric keys,
|
|
generated and RSA-sealed by the TPM. The TPM only unseals the keys,
|
|
if the boot PCRs and other criteria match. Userspace will only ever
|
|
see encrypted blobs.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
config ENCRYPTED_KEYS
|
|
tristate "ENCRYPTED KEYS"
|
|
depends on KEYS
|
|
select CRYPTO
|
|
select CRYPTO_HMAC
|
|
select CRYPTO_AES
|
|
select CRYPTO_CBC
|
|
select CRYPTO_SHA256
|
|
select CRYPTO_RNG
|
|
help
|
|
This option provides support for create/encrypting/decrypting keys
|
|
in the kernel. Encrypted keys are kernel generated random numbers,
|
|
which are encrypted/decrypted with a 'master' symmetric key. The
|
|
'master' key can be either a trusted-key or user-key type.
|
|
Userspace only ever sees/stores encrypted blobs.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|
|
|
|
config KEY_DH_OPERATIONS
|
|
bool "Diffie-Hellman operations on retained keys"
|
|
depends on KEYS
|
|
select CRYPTO
|
|
select CRYPTO_HASH
|
|
select CRYPTO_DH
|
|
help
|
|
This option provides support for calculating Diffie-Hellman
|
|
public keys and shared secrets using values stored as keys
|
|
in the kernel.
|
|
|
|
If you are unsure as to whether this is required, answer N.
|