1# SPDX-License-Identifier: GPL-2.0-only 2config SECURITY_LOADPIN 3 bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 4 depends on SECURITY && BLOCK 5 help 6 Any files read through the kernel file reading interface 7 (kernel modules, firmware, kexec images, security policy) 8 can be pinned to the first filesystem used for loading. When 9 enabled, any files that come from other filesystems will be 10 rejected. This is best used on systems without an initrd that 11 have a root filesystem backed by a read-only device such as 12 dm-verity or a CDROM. 13 14config SECURITY_LOADPIN_ENFORCE 15 bool "Enforce LoadPin at boot" 16 depends on SECURITY_LOADPIN 17 # Module compression breaks LoadPin unless modules are decompressed in 18 # the kernel. 19 depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS) 20 help 21 If selected, LoadPin will enforce pinning at boot. If not 22 selected, it can be enabled at boot with the kernel parameter 23 "loadpin.enforce=1". 24 25config SECURITY_LOADPIN_VERITY 26 bool "Allow reading files from certain other filesystems that use dm-verity" 27 depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS 28 help 29 If selected LoadPin can allow reading files from filesystems 30 that use dm-verity. LoadPin maintains a list of verity root 31 digests it considers trusted. A verity backed filesystem is 32 considered trusted if its root digest is found in the list 33 of trusted digests. 34 35 The list of trusted verity can be populated through an ioctl 36 on the LoadPin securityfs entry 'dm-verity'. The ioctl 37 expects a file descriptor of a file with verity digests as 38 parameter. The file must be located on the pinned root and 39 start with the line: 40 41 # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS 42 43 This is followed by the verity digests, with one digest per 44 line. 45