lkml.org 
[lkml]   [2016]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v2 5/5] LSM: LoadPin for kernel file loading restrictions
    From
    Date
    On Mon, 2016-03-28 at 14:14 -0700, Kees Cook wrote:
    > This LSM enforces that kernel-loaded files (modules, firmware, etc)
    > must all come from the same filesystem, with the expectation that
    > such a filesystem is backed by a read-only device such as dm-verity
    > or CDROM. This allows systems that have a verified and/or unchangeable
    > filesystem to enforce module and firmware loading restrictions without
    > needing to sign the files individually.

    trivia:

    > diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
    []
    > +#define pr_fmt(fmt) "LoadPin: " fmt

    Using

    #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

    would be a lot more common.

    Is there some reason the logging messages should be
    prefixed with "LoadPin: " instead of "loadpin: "?

    \
     
     \ /
      Last update: 2016-03-29 01:41    [W:5.723 / U:0.316 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site