1 # SPDX-License-Identifier: GPL-2.0-only 1 # SPDX-License-Identifier: GPL-2.0-only
2 config SECURITY_LOADPIN 2 config SECURITY_LOADPIN
3 bool "Pin load of kernel files (module 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem"
4 depends on SECURITY && BLOCK 4 depends on SECURITY && BLOCK
5 help 5 help
6 Any files read through the kernel fi 6 Any files read through the kernel file reading interface
7 (kernel modules, firmware, kexec ima 7 (kernel modules, firmware, kexec images, security policy)
8 can be pinned to the first filesyste 8 can be pinned to the first filesystem used for loading. When
9 enabled, any files that come from ot 9 enabled, any files that come from other filesystems will be
10 rejected. This is best used on syste 10 rejected. This is best used on systems without an initrd that
11 have a root filesystem backed by a r 11 have a root filesystem backed by a read-only device such as
12 dm-verity or a CDROM. 12 dm-verity or a CDROM.
13 13
14 config SECURITY_LOADPIN_ENFORCE 14 config SECURITY_LOADPIN_ENFORCE
15 bool "Enforce LoadPin at boot" 15 bool "Enforce LoadPin at boot"
16 depends on SECURITY_LOADPIN 16 depends on SECURITY_LOADPIN
17 # Module compression breaks LoadPin un 17 # Module compression breaks LoadPin unless modules are decompressed in
18 # the kernel. 18 # the kernel.
19 depends on !MODULES || (MODULE_COMPRES 19 depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS)
20 help 20 help
21 If selected, LoadPin will enforce pi 21 If selected, LoadPin will enforce pinning at boot. If not
22 selected, it can be enabled at boot 22 selected, it can be enabled at boot with the kernel parameter
23 "loadpin.enforce=1". 23 "loadpin.enforce=1".
24 24
25 config SECURITY_LOADPIN_VERITY 25 config SECURITY_LOADPIN_VERITY
26 bool "Allow reading files from certain 26 bool "Allow reading files from certain other filesystems that use dm-verity"
27 depends on SECURITY_LOADPIN && DM_VERI 27 depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS
28 help 28 help
29 If selected LoadPin can allow readin 29 If selected LoadPin can allow reading files from filesystems
30 that use dm-verity. LoadPin maintain 30 that use dm-verity. LoadPin maintains a list of verity root
31 digests it considers trusted. A veri 31 digests it considers trusted. A verity backed filesystem is
32 considered trusted if its root diges 32 considered trusted if its root digest is found in the list
33 of trusted digests. 33 of trusted digests.
34 34
35 The list of trusted verity can be po 35 The list of trusted verity can be populated through an ioctl
36 on the LoadPin securityfs entry 'dm- 36 on the LoadPin securityfs entry 'dm-verity'. The ioctl
37 expects a file descriptor of a file 37 expects a file descriptor of a file with verity digests as
38 parameter. The file must be located 38 parameter. The file must be located on the pinned root and
39 start with the line: 39 start with the line:
40 40
41 # LOADPIN_TRUSTED_VERITY_ROOT_DIGEST 41 # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS
42 42
43 This is followed by the verity diges 43 This is followed by the verity digests, with one digest per
44 line. 44 line.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.