Commit b937190c authored by Kees Cook's avatar Kees Cook Committed by James Morris

LSM: LoadPin: provide enablement CONFIG

Instead of being enabled by default when SECURITY_LOADPIN is selected,
provide an additional (default off) config to determine the boot time
behavior. As before, the "loadpin.enabled=0/1" kernel parameter remains
available.
Suggested-by: default avatarJames Morris <jmorris@namei.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent a6926cc9
...@@ -3,8 +3,17 @@ config SECURITY_LOADPIN ...@@ -3,8 +3,17 @@ config SECURITY_LOADPIN
depends on SECURITY && BLOCK depends on SECURITY && BLOCK
help help
Any files read through the kernel file reading interface Any files read through the kernel file reading interface
(kernel modules, firmware, kexec images, security policy) will (kernel modules, firmware, kexec images, security policy)
be pinned to the first filesystem used for loading. Any files can be pinned to the first filesystem used for loading. When
that come from other filesystems will be rejected. This is best enabled, any files that come from other filesystems will be
used on systems without an initrd that have a root filesystem rejected. This is best used on systems without an initrd that
backed by a read-only device such as dm-verity or a CDROM. have a root filesystem backed by a read-only device such as
dm-verity or a CDROM.
config SECURITY_LOADPIN_ENABLED
bool "Enforce LoadPin at boot"
depends on SECURITY_LOADPIN
help
If selected, LoadPin will enforce pinning at boot. If not
selected, it can be enabled at boot with the kernel parameter
"loadpin.enabled=1".
...@@ -45,7 +45,7 @@ static void report_load(const char *origin, struct file *file, char *operation) ...@@ -45,7 +45,7 @@ static void report_load(const char *origin, struct file *file, char *operation)
kfree(pathname); kfree(pathname);
} }
static int enabled = 1; static int enabled = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENABLED);
static struct super_block *pinned_root; static struct super_block *pinned_root;
static DEFINE_SPINLOCK(pinned_root_spinlock); static DEFINE_SPINLOCK(pinned_root_spinlock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment