1 =======
2 LoadPin
3 =======
4
5 LoadPin is a Linux Security Module that ensures all kernel-loaded files
6 (modules, firmware, etc) all originate from the same filesystem, with
7 the expectation that such a filesystem is backed by a read-only device
8 such as dm-verity or CDROM. This allows systems that have a verified
9 and/or unchangeable filesystem to enforce module and firmware loading
10 restrictions without needing to sign the files individually.
11
12 The LSM is selectable at build-time with ``CONFIG_SECURITY_LOADPIN``, and
13 can be controlled at boot-time with the kernel command line option
14 "``loadpin.enforce``". By default, it is enabled, but can be disabled at
15 boot ("``loadpin.enforce=0``").
16
17 LoadPin starts pinning when it sees the first file loaded. If the
18 block device backing the filesystem is not read-only, a sysctl is
19 created to toggle pinning: ``/proc/sys/kernel/loadpin/enabled``. (Having
20 a mutable filesystem means pinning is mutable too, but having the
21 sysctl allows for easy testing on systems with a mutable filesystem.)
22
23 It's also possible to exclude specific file types from LoadPin using kernel
24 command line option "``loadpin.exclude``". By default, all files are
25 included, but they can be excluded using kernel command line option such
26 as "``loadpin.exclude=kernel-module,kexec-image``". This allows to use
27 different mechanisms such as ``CONFIG_MODULE_SIG`` and
28 ``CONFIG_KEXEC_VERIFY_SIG`` to verify kernel module and kernel image while
29 still use LoadPin to protect the integrity of other files kernel loads. The
30 full list of valid file types can be found in ``kernel_read_file_str``
31 defined in ``include/linux/kernel_read_file.h``.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.