9b091556a0
This LSM enforces that kernel-loaded files (modules, firmware, etc) must all come from the same filesystem, with the expectation that such a filesystem is backed by a read-only device such as dm-verity or CDROM. This allows systems that have a verified and/or unchangeable filesystem to enforce module and firmware loading restrictions without needing to sign the files individually. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com> |
||
|---|---|---|
| .. | ||
| 00-INDEX | ||
| apparmor.txt | ||
| credentials.txt | ||
| IMA-templates.txt | ||
| keys-ecryptfs.txt | ||
| keys-request-key.txt | ||
| keys-trusted-encrypted.txt | ||
| keys.txt | ||
| LoadPin.txt | ||
| LSM.txt | ||
| SELinux.txt | ||
| Smack.txt | ||
| tomoyo.txt | ||
| Yama.txt | ||