-
Kees Cook authored
Now that kernel module origins can be reasoned about, provide a hook to the LSMs to make policy decisions about the module file. This will let Chrome OS enforce that loadable kernel modules can only come from its read-only hash-verified root filesystem. Other LSMs can, for example, read extended attributes for signatures, etc. Signed-off-by:
Kees Cook <keescook@chromium.org> Acked-by:
Serge E. Hallyn <serge.hallyn@canonical.com> Acked-by:
Eric Paris <eparis@redhat.com> Acked-by:
Mimi Zohar <zohar@us.ibm.com> Acked-by:
James Morris <james.l.morris@oracle.com> Signed-off-by:
Rusty Russell <rusty@rustcorp.com.au>
2e72d51b