Re: [PATCH v5 0/6] LSM: LoadPin for kernel file loading restrictions

From	James Morris <jmorris@namei.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH v5 0/6] LSM: LoadPin for kernel file loading restrictions
Date	2016-04-21 02:30 +0200
Message-ID	<rqaFk-8rW-7@gated-at.bofh.it> (permalink)
References	<rq96y-799-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, 20 Apr 2016, Kees Cook wrote:

> This provides the mini-LSM "loadpin" that intercepts the now consolidated
> kernel_file_read LSM hook so that a system can keep all loads coming from
> a single trusted filesystem. This is what Chrome OS uses to pin kernel
> module and firmware loading to the read-only crypto-verified dm-verity
> partition so that kernel module signing is not needed.
> 

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next


-- 
James Morris
<jmorris@namei.org>

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v5 0/6] LSM: LoadPin for kernel file loading restrictions Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
  [PATCH 2/6] string_helpers: add kstrdup_quotable_cmdline Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
  [PATCH 6/6] LSM: LoadPin for kernel file loading restrictions Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
  [PATCH 3/6] string_helpers: add kstrdup_quotable_file Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
  [PATCH 4/6] Yama: consolidate error reporting Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
  [PATCH 5/6] fs: define a string representation of the kernel_read_file_id enumeration Kees Cook <keescook@chromium.org> - 2016-04-21 00:50 +0200
    Re: [PATCH 5/6] fs: define a string representation of the  kernel_read_file_id enumeration Andy Shevchenko <andriy.shevchenko@linux.intel.com> - 2016-04-21 15:30 +0200
      Re: [PATCH 5/6] fs: define a string representation of the  kernel_read_file_id enumeration Kees Cook <keescook@chromium.org> - 2016-04-21 18:50 +0200
        Re: [PATCH 5/6] fs: define a string representation of the  kernel_read_file_id enumeration Andy Shevchenko <andriy.shevchenko@linux.intel.com> - 2016-04-21 19:20 +0200
  Re: [PATCH v5 0/6] LSM: LoadPin for kernel file loading  restrictions James Morris <jmorris@namei.org> - 2016-04-21 02:30 +0200

csiph-web