Kconfig 821 B

1234567891011121314151617181920
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. config SECURITY_LOADPIN
  3. bool "Pin load of kernel files (modules, fw, etc) to one filesystem"
  4. depends on SECURITY && BLOCK
  5. help
  6. Any files read through the kernel file reading interface
  7. (kernel modules, firmware, kexec images, security policy)
  8. can be pinned to the first filesystem used for loading. When
  9. enabled, any files that come from other filesystems will be
  10. rejected. This is best used on systems without an initrd that
  11. have a root filesystem backed by a read-only device such as
  12. dm-verity or a CDROM.
  13. config SECURITY_LOADPIN_ENFORCE
  14. bool "Enforce LoadPin at boot"
  15. depends on SECURITY_LOADPIN
  16. help
  17. If selected, LoadPin will enforce pinning at boot. If not
  18. selected, it can be enabled at boot with the kernel parameter
  19. "loadpin.enforce=1".