| Kconfig (4f2c0a4acffbec01079c28f839422e64ddeff004) | Kconfig (ce0d73ef8dea52d7253bdc2fd3cc3e89d7089ded) |
|---|---|
| 1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_LOADPIN 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 4 depends on SECURITY && BLOCK 5 help 6 Any files read through the kernel file reading interface 7 (kernel modules, firmware, kexec images, security policy) 8 can be pinned to the first filesystem used for loading. When 9 enabled, any files that come from other filesystems will be 10 rejected. This is best used on systems without an initrd that 11 have a root filesystem backed by a read-only device such as 12 dm-verity or a CDROM. 13 14config SECURITY_LOADPIN_ENFORCE 15 bool "Enforce LoadPin at boot" 16 depends on SECURITY_LOADPIN | 1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_LOADPIN 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 4 depends on SECURITY && BLOCK 5 help 6 Any files read through the kernel file reading interface 7 (kernel modules, firmware, kexec images, security policy) 8 can be pinned to the first filesystem used for loading. When 9 enabled, any files that come from other filesystems will be 10 rejected. This is best used on systems without an initrd that 11 have a root filesystem backed by a read-only device such as 12 dm-verity or a CDROM. 13 14config SECURITY_LOADPIN_ENFORCE 15 bool "Enforce LoadPin at boot" 16 depends on SECURITY_LOADPIN |
| 17 # Module compression breaks LoadPin unless modules are decompressed in 18 # the kernel. 19 depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS) |
|
| 17 help 18 If selected, LoadPin will enforce pinning at boot. If not 19 selected, it can be enabled at boot with the kernel parameter 20 "loadpin.enforce=1". 21 22config SECURITY_LOADPIN_VERITY 23 bool "Allow reading files from certain other filesystems that use dm-verity" 24 depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS --- 17 unchanged lines hidden --- | 20 help 21 If selected, LoadPin will enforce pinning at boot. If not 22 selected, it can be enabled at boot with the kernel parameter 23 "loadpin.enforce=1". 24 25config SECURITY_LOADPIN_VERITY 26 bool "Allow reading files from certain other filesystems that use dm-verity" 27 depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS --- 17 unchanged lines hidden --- |