tree 9ba238f99bca8f5de00e105244c3fd74ec46632c
parent cd6c84d8f0cdc911df435bb075ba22ce3c605b07
author Ke Wu <mikewu@google.com> 1559244128 -0700
committer Kees Cook <keescook@chromium.org> 1559336260 -0700

security/loadpin: Allow to exclude specific file types

Linux kernel already provide MODULE_SIG and KEXEC_VERIFY_SIG to
make sure loaded kernel module and kernel image are trusted. This
patch adds a kernel command line option "loadpin.exclude" which
allows to exclude specific file types from LoadPin. This is useful
when people want to use different mechanisms to verify module and
kernel image while still use LoadPin to protect the integrity of
other files kernel loads.

Signed-off-by: Ke Wu <mikewu@google.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
[kees: fix array size issue reported by Coverity via Colin Ian King]
Signed-off-by: Kees Cook <keescook@chromium.org>