| Kconfig (aafc203bbad4bf6cf394a34ea698c2b0b8affae0) | Kconfig (6e42aec7c75947e0d6b38400628f171364eb8231) |
|---|---|
| 1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_LOADPIN 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 4 depends on SECURITY && BLOCK 5 help 6 Any files read through the kernel file reading interface 7 (kernel modules, firmware, kexec images, security policy) 8 can be pinned to the first filesystem used for loading. When --- 19 unchanged lines hidden (view full) --- 28 digests it considers trusted. A verity backed filesystem is 29 considered trusted if its root digest is found in the list 30 of trusted digests. 31 32 The list of trusted verity can be populated through an ioctl 33 on the LoadPin securityfs entry 'dm-verity'. The ioctl 34 expects a file descriptor of a file with verity digests as 35 parameter. The file must be located on the pinned root and | 1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_LOADPIN 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 4 depends on SECURITY && BLOCK 5 help 6 Any files read through the kernel file reading interface 7 (kernel modules, firmware, kexec images, security policy) 8 can be pinned to the first filesystem used for loading. When --- 19 unchanged lines hidden (view full) --- 28 digests it considers trusted. A verity backed filesystem is 29 considered trusted if its root digest is found in the list 30 of trusted digests. 31 32 The list of trusted verity can be populated through an ioctl 33 on the LoadPin securityfs entry 'dm-verity'. The ioctl 34 expects a file descriptor of a file with verity digests as 35 parameter. The file must be located on the pinned root and |
| 36 contain one digest per line. | 36 start with the line: 37 38 # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS 39 40 This is followed by the verity digests, with one digest per 41 line. |