Searched hist:"13523 bef1e2154b6d02836cd0f6c0ffc89b2eae6" (Results 1 – 2 of 2) sorted by relevance
| /linux/security/loadpin/ |
| H A D | Kconfig | diff 13523bef1e2154b6d02836cd0f6c0ffc89b2eae6 Mon Sep 24 23:43:59 CEST 2018 Kees Cook <keescook@chromium.org> LoadPin: Rename boot param "enabled" to "enforce"
LoadPin's "enabled" setting is really about enforcement, not whether
or not the LSM is using LSM hooks. Instead, split this out so that LSM
enabling can be logically distinct from whether enforcement is happening
(for example, the pinning happens when the LSM is enabled, but the pin
is only checked when "enforce" is set). This allows LoadPin to continue
to operate sanely in test environments once LSM enable/disable is
centrally handled (i.e. we want LoadPin to be enabled separately from
its enforcement).
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
|
| H A D | loadpin.c | diff 13523bef1e2154b6d02836cd0f6c0ffc89b2eae6 Mon Sep 24 23:43:59 CEST 2018 Kees Cook <keescook@chromium.org> LoadPin: Rename boot param "enabled" to "enforce"
LoadPin's "enabled" setting is really about enforcement, not whether
or not the LSM is using LSM hooks. Instead, split this out so that LSM
enabling can be logically distinct from whether enforcement is happening
(for example, the pinning happens when the LSM is enabled, but the pin
is only checked when "enforce" is set). This allows LoadPin to continue
to operate sanely in test environments once LSM enable/disable is
centrally handled (i.e. we want LoadPin to be enabled separately from
its enforcement).
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
|