1 =======
2 LoadPin
3 =======
4
5 LoadPin is a Linux Security Module that ensure
6 (modules, firmware, etc) all originate from th
7 the expectation that such a filesystem is back
8 such as dm-verity or CDROM. This allows system
9 and/or unchangeable filesystem to enforce modu
10 restrictions without needing to sign the files
11
12 The LSM is selectable at build-time with ``CON
13 can be controlled at boot-time with the kernel
14 "``loadpin.enforce``". By default, it is enabl
15 boot ("``loadpin.enforce=0``").
16
17 LoadPin starts pinning when it sees the first
18 block device backing the filesystem is not rea
19 created to toggle pinning: ``/proc/sys/kernel/
20 a mutable filesystem means pinning is mutable
21 sysctl allows for easy testing on systems with
22
23 It's also possible to exclude specific file ty
24 command line option "``loadpin.exclude``". By
25 included, but they can be excluded using kerne
26 as "``loadpin.exclude=kernel-module,kexec-imag
27 different mechanisms such as ``CONFIG_MODULE_S
28 ``CONFIG_KEXEC_VERIFY_SIG`` to verify kernel m
29 still use LoadPin to protect the integrity of
30 full list of valid file types can be found in
31 defined in ``include/linux/kernel_read_file.h`
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.