tree 075fffff80b5caad9738f633c83333dea9e04efd
parent 1284ab5b2dcb927d38e4f3fbc2e307f3d1af9262
author Kees Cook <keescook@chromium.org> 1461192388 -0700
committer James Morris <james.l.morris@oracle.com> 1461199647 +1000

LSM: LoadPin for kernel file loading restrictions

This LSM enforces that kernel-loaded files (modules, firmware, etc)
must all come from the same filesystem, with the expectation that
such a filesystem is backed by a read-only device such as dm-verity
or CDROM. This allows systems that have a verified and/or unchangeable
filesystem to enforce module and firmware loading restrictions without
needing to sign the files individually.

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>