diff options
| author | Kees Cook | 2016-04-21 00:46:28 +0200 |
|---|---|---|
| committer | James Morris | 2016-04-21 02:47:27 +0200 |
| commit | 9b091556a073a9f5f93e2ad23d118f45c4796a84 (patch) | |
| tree | 075fffff80b5caad9738f633c83333dea9e04efd /security/Kconfig | |
| parent | fs: define a string representation of the kernel_read_file_id enumeration (diff) | |
| download | kernel-qcow2-linux-9b091556a073a9f5f93e2ad23d118f45c4796a84.tar.gz kernel-qcow2-linux-9b091556a073a9f5f93e2ad23d118f45c4796a84.tar.xz kernel-qcow2-linux-9b091556a073a9f5f93e2ad23d118f45c4796a84.zip | |
LSM: LoadPin for kernel file loading restrictions
This LSM enforces that kernel-loaded files (modules, firmware, etc)
must all come from the same filesystem, with the expectation that
such a filesystem is backed by a read-only device such as dm-verity
or CDROM. This allows systems that have a verified and/or unchangeable
filesystem to enforce module and firmware loading restrictions without
needing to sign the files individually.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security/Kconfig')
| -rw-r--r-- | security/Kconfig | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/security/Kconfig b/security/Kconfig index e45237897b43..176758cdfa57 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -122,6 +122,7 @@ source security/selinux/Kconfig source security/smack/Kconfig source security/tomoyo/Kconfig source security/apparmor/Kconfig +source security/loadpin/Kconfig source security/yama/Kconfig source security/integrity/Kconfig |