fsverity: improve documentation for builtin signature support

[linux-2.6-microblaze.git] / fs / verity / Kconfig

diff --git a/fs/verity/Kconfig b/fs/verity/Kconfig
index a7ffd71..e1036e5 100644 (file)
--- a/fs/verity/Kconfig
+++ b/fs/verity/Kconfig
@@ -39,14 +39,14 @@ config FS_VERITY_BUILTIN_SIGNATURES
        depends on FS_VERITY
        select SYSTEM_DATA_VERIFICATION
        help
-         Support verifying signatures of verity files against the X.509
-         certificates that have been loaded into the ".fs-verity"
-         kernel keyring.
+         This option adds support for in-kernel verification of
+         fs-verity builtin signatures.
 
-         This is meant as a relatively simple mechanism that can be
-         used to provide an authenticity guarantee for verity files, as
-         an alternative to IMA appraisal.  Userspace programs still
-         need to check that the verity bit is set in order to get an
-         authenticity guarantee.
+         Please take great care before using this feature.  It is not
+         the only way to do signatures with fs-verity, and the
+         alternatives (such as userspace signature verification, and
+         IMA appraisal) can be much better.  For details about the
+         limitations of this feature, see
+         Documentation/filesystems/fsverity.rst.
 
          If unsure, say N.