1======= 2LoadPin 3======= 4 5LoadPin is a Linux Security Module that ensures all kernel-loaded files 6(modules, firmware, etc) all originate from the same filesystem, with 7the expectation that such a filesystem is backed by a read-only device 8such as dm-verity or CDROM. This allows systems that have a verified 9and/or unchangeable filesystem to enforce module and firmware loading 10restrictions without needing to sign the files individually. 11 12The LSM is selectable at build-time with ``CONFIG_SECURITY_LOADPIN``, and 13can be controlled at boot-time with the kernel command line option 14"``loadpin.enforce``". By default, it is enabled, but can be disabled at 15boot ("``loadpin.enforce=0``"). 16 17LoadPin starts pinning when it sees the first file loaded. If the 18block device backing the filesystem is not read-only, a sysctl is 19created to toggle pinning: ``/proc/sys/kernel/loadpin/enabled``. (Having 20a mutable filesystem means pinning is mutable too, but having the 21sysctl allows for easy testing on systems with a mutable filesystem.) 22 23It's also possible to exclude specific file types from LoadPin using kernel 24command line option "``loadpin.exclude``". By default, all files are 25included, but they can be excluded using kernel command line option such 26as "``loadpin.exclude=kernel-module,kexec-image``". This allows using 27different mechanisms such as ``CONFIG_MODULE_SIG`` and 28``CONFIG_KEXEC_SIG`` to verify kernel modules and kernel images while 29still using LoadPin to protect the integrity of other files the kernel 30loads. The full list of valid file types can be found in 31``kernel_read_file_str`` defined in ``include/linux/kernel_read_file.h``. 32