GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-03-21 22:55:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

LSM: LoadPin: provide enablement CONFIG

Browse source 
Instead of being enabled by default when SECURITY_LOADPIN is selected,
provide an additional (default off) config to determine the boot time
behavior. As before, the "loadpin.enabled=0/1" kernel parameter remains
available.

Suggested-by: James Morris <jmorris@namei.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
Kees Cook 2016-05-17 01:45:52 -07:00 • committed by James Morris
parent a6926cc989
commit b937190c40
2 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
security/loadpin/Kconfig
View file

@ -3,8 +3,17 @@ config SECURITY_LOADPIN
depends on SECURITY && BLOCK depends on SECURITY && BLOCK
help help
Any files read through the kernel file reading interface Any files read through the kernel file reading interface
(kernel modules, firmware, kexec images, security policy) will (kernel modules, firmware, kexec images, security policy)
be pinned to the first filesystem used for loading. Any files can be pinned to the first filesystem used for loading. When
that come from other filesystems will be rejected. This is best enabled, any files that come from other filesystems will be
used on systems without an initrd that have a root filesystem rejected. This is best used on systems without an initrd that
backed by a read-only device such as dm-verity or a CDROM. have a root filesystem backed by a read-only device such as
dm-verity or a CDROM.
config SECURITY_LOADPIN_ENABLED
bool "Enforce LoadPin at boot"
depends on SECURITY_LOADPIN
help
If selected, LoadPin will enforce pinning at boot. If not
selected, it can be enabled at boot with the kernel parameter
"loadpin.enabled=1".

2
security/loadpin/loadpin.c
View file

@ -45,7 +45,7 @@ static void report_load(const char *origin, struct file *file, char *operation)
kfree(pathname); kfree(pathname);
} }
static int enabled = 1; static int enabled = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENABLED);
static struct super_block *pinned_root; static struct super_block *pinned_root;
static DEFINE_SPINLOCK(pinned_root_spinlock); static DEFINE_SPINLOCK(pinned_root_spinlock);