1# SPDX-License-Identifier: GPL-2.0-only
 2config SECURITY_LOADPIN
 3	bool "Pin load of kernel files (modules, fw, etc) to one filesystem"
 4	depends on SECURITY && BLOCK
 5	help
 6	  Any files read through the kernel file reading interface
 7	  (kernel modules, firmware, kexec images, security policy)
 8	  can be pinned to the first filesystem used for loading. When
 9	  enabled, any files that come from other filesystems will be
10	  rejected. This is best used on systems without an initrd that
11	  have a root filesystem backed by a read-only device such as
12	  dm-verity or a CDROM.
13
14config SECURITY_LOADPIN_ENFORCE
15	bool "Enforce LoadPin at boot"
16	depends on SECURITY_LOADPIN
17	# Module compression breaks LoadPin unless modules are decompressed in
18	# the kernel.
19	depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS)
20	help
21	  If selected, LoadPin will enforce pinning at boot. If not
22	  selected, it can be enabled at boot with the kernel parameter
23	  "loadpin.enforce=1".
24
25config SECURITY_LOADPIN_VERITY
26	bool "Allow reading files from certain other filesystems that use dm-verity"
27	depends on SECURITY_LOADPIN && DM_VERITY=y && SECURITYFS
28	help
29	  If selected LoadPin can allow reading files from filesystems
30	  that use dm-verity. LoadPin maintains a list of verity root
31	  digests it considers trusted. A verity backed filesystem is
32	  considered trusted if its root digest is found in the list
33	  of trusted digests.
34
35	  The list of trusted verity can be populated through an ioctl
36	  on the LoadPin securityfs entry 'dm-verity'. The ioctl
37	  expects a file descriptor of a file with verity digests as
38	  parameter. The file must be located on the pinned root and
39	  start with the line:
40
41	  # LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS
42
43	  This is followed by the verity digests, with one digest per
44	  line.