Add the rt linux 4.1.3-rt3 as base

[kvmfornfv.git] / kernel / security / keys / Kconfig

diff --git a/kernel/security/keys/Kconfig b/kernel/security/keys/Kconfig
new file mode 100644 (file)
index 0000000..72483b8
--- /dev/null
+++ b/kernel/security/keys/Kconfig
@@ -0,0 +1,82 @@
+#
+# Key management configuration
+#
+
+config KEYS
+       bool "Enable access key retention support"
+       select ASSOCIATIVE_ARRAY
+       help
+         This option provides support for retaining authentication tokens and
+         access keys in the kernel.
+
+         It also includes provision of methods by which such keys might be
+         associated with a process so that network filesystems, encryption
+         support and the like can find them.
+
+         Furthermore, a special type of key is available that acts as keyring:
+         a searchable sequence of keys. Each process is equipped with access
+         to five standard keyrings: UID-specific, GID-specific, session,
+         process and thread.
+
+         If you are unsure as to whether this is required, answer N.
+
+config PERSISTENT_KEYRINGS
+       bool "Enable register of persistent per-UID keyrings"
+       depends on KEYS
+       help
+         This option provides a register of persistent per-UID keyrings,
+         primarily aimed at Kerberos key storage.  The keyrings are persistent
+         in the sense that they stay around after all processes of that UID
+         have exited, not that they survive the machine being rebooted.
+
+         A particular keyring may be accessed by either the user whose keyring
+         it is or by a process with administrative privileges.  The active
+         LSMs gets to rule on which admin-level processes get to access the
+         cache.
+
+         Keyrings are created and added into the register upon demand and get
+         removed if they expire (a default timeout is set upon creation).
+
+config BIG_KEYS
+       bool "Large payload keys"
+       depends on KEYS
+       depends on TMPFS
+       help
+         This option provides support for holding large keys within the kernel
+         (for example Kerberos ticket caches).  The data may be stored out to
+         swapspace by tmpfs.
+
+         If you are unsure as to whether this is required, answer N.
+
+config TRUSTED_KEYS
+       tristate "TRUSTED KEYS"
+       depends on KEYS && TCG_TPM
+       select CRYPTO
+       select CRYPTO_HMAC
+       select CRYPTO_SHA1
+       help
+         This option provides support for creating, sealing, and unsealing
+         keys in the kernel. Trusted keys are random number symmetric keys,
+         generated and RSA-sealed by the TPM. The TPM only unseals the keys,
+         if the boot PCRs and other criteria match.  Userspace will only ever
+         see encrypted blobs.
+
+         If you are unsure as to whether this is required, answer N.
+
+config ENCRYPTED_KEYS
+       tristate "ENCRYPTED KEYS"
+       depends on KEYS
+       select CRYPTO
+       select CRYPTO_HMAC
+       select CRYPTO_AES
+       select CRYPTO_CBC
+       select CRYPTO_SHA256
+       select CRYPTO_RNG
+       help
+         This option provides support for create/encrypting/decrypting keys
+         in the kernel.  Encrypted keys are kernel generated random numbers,
+         which are encrypted/decrypted with a 'master' symmetric key. The
+         'master' key can be either a trusted-key or user-key type.
+         Userspace only ever sees/stores encrypted blobs.
+
+         If you are unsure as to whether this is required, answer N.