Merge tag 'modsign-pkcs7-20150814' of git://git.kernel.org/pub/scm/linux/kernel/git...

[cascardo/linux.git] / init / Kconfig

diff --git a/init/Kconfig b/init/Kconfig
index 2b11985..5526dfa 100644 (file)
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1740,18 +1740,6 @@ config MMAP_ALLOW_UNINITIALIZED
 
          See Documentation/nommu-mmap.txt for more information.
 
-config SYSTEM_TRUSTED_KEYRING
-       bool "Provide system-wide ring of trusted keys"
-       depends on KEYS
-       help
-         Provide a system keyring to which trusted keys can be added.  Keys in
-         the keyring are considered to be trusted.  Keys may be added at will
-         by the kernel from compiled-in data and from hardware key stores, but
-         userspace may only add extra keys if those keys can be verified by
-         keys already in the keyring.
-
-         Keys in this keyring are used by module signature checking.
-
 config SYSTEM_DATA_VERIFICATION
        def_bool n
        select SYSTEM_TRUSTED_KEYRING
@@ -1884,6 +1872,10 @@ config MODULE_SIG
          is simply appended to the module. For more information see
          Documentation/module-signing.txt.
 
+         Note that this option adds the OpenSSL development packages as a
+         kernel build dependency so that the signing tool can use its crypto
+         library.
+
          !!!WARNING!!!  If you enable this option, you MUST make sure that the
          module DOES NOT get stripped after being signed.  This includes the
          debuginfo strip done by some packagers (such as rpmbuild) and
@@ -1948,20 +1940,6 @@ config MODULE_SIG_HASH
        default "sha384" if MODULE_SIG_SHA384
        default "sha512" if MODULE_SIG_SHA512
 
-config MODULE_SIG_KEY
-       string "File name or PKCS#11 URI of module signing key"
-       default "signing_key.pem"
-       depends on MODULE_SIG
-       help
-         Provide the file name of a private key/certificate in PEM format,
-         or a PKCS#11 URI according to RFC7512. The file should contain, or
-         the URI should identify, both the certificate and its corresponding
-         private key.
-
-         If this option is unchanged from its default "signing_key.pem",
-         then the kernel will automatically generate the private key and
-         certificate as described in Documentation/module-signing.txt
-
 config MODULE_COMPRESS
        bool "Compress modules on installation"
        depends on MODULES