162306a36Sopenharmony_ci# SPDX-License-Identifier: GPL-2.0-only 262306a36Sopenharmony_ciconfig SECURITY_LOADPIN 362306a36Sopenharmony_ci bool "Pin load of kernel files (modules, fw, etc) to one filesystem" 462306a36Sopenharmony_ci depends on SECURITY && BLOCK 562306a36Sopenharmony_ci help 662306a36Sopenharmony_ci Any files read through the kernel file reading interface 762306a36Sopenharmony_ci (kernel modules, firmware, kexec images, security policy) 862306a36Sopenharmony_ci can be pinned to the first filesystem used for loading. When 962306a36Sopenharmony_ci enabled, any files that come from other filesystems will be 1062306a36Sopenharmony_ci rejected. This is best used on systems without an initrd that 1162306a36Sopenharmony_ci have a root filesystem backed by a read-only device such as 1262306a36Sopenharmony_ci dm-verity or a CDROM. 1362306a36Sopenharmony_ci 1462306a36Sopenharmony_ciconfig SECURITY_LOADPIN_ENFORCE 1562306a36Sopenharmony_ci bool "Enforce LoadPin at boot" 1662306a36Sopenharmony_ci depends on SECURITY_LOADPIN 1762306a36Sopenharmony_ci help 1862306a36Sopenharmony_ci If selected, LoadPin will enforce pinning at boot. If not 1962306a36Sopenharmony_ci selected, it can be enabled at boot with the kernel parameter 2062306a36Sopenharmony_ci "loadpin.enforce=1". 2162306a36Sopenharmony_ci 2262306a36Sopenharmony_ciconfig SECURITY_LOADPIN_VERITY 2362306a36Sopenharmony_ci bool "Allow reading files from certain other filesystems that use dm-verity" 2462306a36Sopenharmony_ci depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS 2562306a36Sopenharmony_ci help 2662306a36Sopenharmony_ci If selected LoadPin can allow reading files from filesystems 2762306a36Sopenharmony_ci that use dm-verity. LoadPin maintains a list of verity root 2862306a36Sopenharmony_ci digests it considers trusted. A verity backed filesystem is 2962306a36Sopenharmony_ci considered trusted if its root digest is found in the list 3062306a36Sopenharmony_ci of trusted digests. 3162306a36Sopenharmony_ci 3262306a36Sopenharmony_ci The list of trusted verity can be populated through an ioctl 3362306a36Sopenharmony_ci on the LoadPin securityfs entry 'dm-verity'. The ioctl 3462306a36Sopenharmony_ci expects a file descriptor of a file with verity digests as 3562306a36Sopenharmony_ci parameter. The file must be located on the pinned root and 3662306a36Sopenharmony_ci start with the line: 3762306a36Sopenharmony_ci 3862306a36Sopenharmony_ci # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS 3962306a36Sopenharmony_ci 4062306a36Sopenharmony_ci This is followed by the verity digests, with one digest per 4162306a36Sopenharmony_ci line. 42