mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-16 13:34:30 +00:00
aafc203bba
The doc for CONFIG_SECURITY_LOADPIN_VERITY says that the file with verity
digests must contain a comma separated list of digests. That was the case
at some stage of the development, but was changed during the review
process to one digest per line. Update the Kconfig doc accordingly.
Reported-by: Jae Hoon Kim <kimjae@chromium.org>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Fixes: 3f805f8cc23b ("LoadPin: Enable loading from trusted dm-verity devices")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220829174557.1.I5d202d1344212a3800d9828f936df6511eb2d0d1@changeid
37 lines
1.5 KiB
Plaintext
37 lines
1.5 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config SECURITY_LOADPIN
|
|
bool "Pin load of kernel files (modules, fw, etc) to one filesystem"
|
|
depends on SECURITY && BLOCK
|
|
help
|
|
Any files read through the kernel file reading interface
|
|
(kernel modules, firmware, kexec images, security policy)
|
|
can be pinned to the first filesystem used for loading. When
|
|
enabled, any files that come from other filesystems will be
|
|
rejected. This is best used on systems without an initrd that
|
|
have a root filesystem backed by a read-only device such as
|
|
dm-verity or a CDROM.
|
|
|
|
config SECURITY_LOADPIN_ENFORCE
|
|
bool "Enforce LoadPin at boot"
|
|
depends on SECURITY_LOADPIN
|
|
help
|
|
If selected, LoadPin will enforce pinning at boot. If not
|
|
selected, it can be enabled at boot with the kernel parameter
|
|
"loadpin.enforce=1".
|
|
|
|
config SECURITY_LOADPIN_VERITY
|
|
bool "Allow reading files from certain other filesystems that use dm-verity"
|
|
depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS
|
|
help
|
|
If selected LoadPin can allow reading files from filesystems
|
|
that use dm-verity. LoadPin maintains a list of verity root
|
|
digests it considers trusted. A verity backed filesystem is
|
|
considered trusted if its root digest is found in the list
|
|
of trusted digests.
|
|
|
|
The list of trusted verity can be populated through an ioctl
|
|
on the LoadPin securityfs entry 'dm-verity'. The ioctl
|
|
expects a file descriptor of a file with verity digests as
|
|
parameter. The file must be located on the pinned root and
|
|
contain one digest per line.
|