diff options
| author | Kees Cook | 2018-09-24 23:43:59 +0200 |
|---|---|---|
| committer | Kees Cook | 2018-10-19 00:29:44 +0200 |
| commit | 13523bef1e2154b6d02836cd0f6c0ffc89b2eae6 (patch) | |
| tree | eb769876befa1a7c81ed78748d9ccc0d3ec46501 /security/loadpin/Kconfig | |
| parent | LoadPin: Report friendly block device name (diff) | |
| download | kernel-qcow2-linux-13523bef1e2154b6d02836cd0f6c0ffc89b2eae6.tar.gz kernel-qcow2-linux-13523bef1e2154b6d02836cd0f6c0ffc89b2eae6.tar.xz kernel-qcow2-linux-13523bef1e2154b6d02836cd0f6c0ffc89b2eae6.zip | |
LoadPin: Rename boot param "enabled" to "enforce"
LoadPin's "enabled" setting is really about enforcement, not whether
or not the LSM is using LSM hooks. Instead, split this out so that LSM
enabling can be logically distinct from whether enforcement is happening
(for example, the pinning happens when the LSM is enabled, but the pin
is only checked when "enforce" is set). This allows LoadPin to continue
to operate sanely in test environments once LSM enable/disable is
centrally handled (i.e. we want LoadPin to be enabled separately from
its enforcement).
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/loadpin/Kconfig')
| -rw-r--r-- | security/loadpin/Kconfig | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/loadpin/Kconfig b/security/loadpin/Kconfig index dd01aa91e521..a0d70d82b98e 100644 --- a/security/loadpin/Kconfig +++ b/security/loadpin/Kconfig @@ -10,10 +10,10 @@ config SECURITY_LOADPIN have a root filesystem backed by a read-only device such as dm-verity or a CDROM. -config SECURITY_LOADPIN_ENABLED +config SECURITY_LOADPIN_ENFORCE bool "Enforce LoadPin at boot" depends on SECURITY_LOADPIN help If selected, LoadPin will enforce pinning at boot. If not selected, it can be enabled at boot with the kernel parameter - "loadpin.enabled=1". + "loadpin.enforce=1". |