| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | config SECURITY_LOADPIN |
| 3 | bool "Pin load of kernel files (modules, fw, etc) to one filesystem" |
| 4 | depends on SECURITY && BLOCK |
| 5 | help |
| 6 | Any files read through the kernel file reading interface |
| 7 | (kernel modules, firmware, kexec images, security policy) |
| 8 | can be pinned to the first filesystem used for loading. When |
| 9 | enabled, any files that come from other filesystems will be |
| 10 | rejected. This is best used on systems without an initrd that |
| 11 | have a root filesystem backed by a read-only device such as |
| 12 | dm-verity or a CDROM. |
| 13 | |
| 14 | config SECURITY_LOADPIN_ENFORCE |
| 15 | bool "Enforce LoadPin at boot" |
| 16 | depends on SECURITY_LOADPIN |
| 17 | # Module compression breaks LoadPin unless modules are decompressed in |
| 18 | # the kernel. |
| 19 | depends on !MODULE_COMPRESS || MODULE_DECOMPRESS |
| 20 | help |
| 21 | If selected, LoadPin will enforce pinning at boot. If not |
| 22 | selected, it can be enabled at boot with the kernel parameter |
| 23 | "loadpin.enforce=1". |
| 24 | |
| 25 | config SECURITY_LOADPIN_VERITY |
| 26 | bool "Allow reading files from certain other filesystems that use dm-verity" |
| 27 | depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS |
| 28 | help |
| 29 | If selected LoadPin can allow reading files from filesystems |
| 30 | that use dm-verity. LoadPin maintains a list of verity root |
| 31 | digests it considers trusted. A verity backed filesystem is |
| 32 | considered trusted if its root digest is found in the list |
| 33 | of trusted digests. |
| 34 | |
| 35 | The list of trusted verity can be populated through an ioctl |
| 36 | on the LoadPin securityfs entry 'dm-verity'. The ioctl |
| 37 | expects a file descriptor of a file with verity digests as |
| 38 | parameter. The file must be located on the pinned root and |
| 39 | start with the line: |
| 40 | |
| 41 | # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS |
| 42 | |
| 43 | This is followed by the verity digests, with one digest per |
| 44 | line. |