CONFIG_SECURITY_LOADPIN_VERITY: Allow reading files from certain other filesystems that use dm-verity

General informations

The Linux kernel configuration item CONFIG_SECURITY_LOADPIN_VERITY:

• prompt: Allow reading files from certain other filesystems that use dm-verity
• type: bool
• depends on: CONFIG_SECURITY_LOADPIN && CONFIG_DM_VERITY = CONFIG_y && CONFIG_SECURITYFS
• defined in security/loadpin/Kconfig
• found in Linux kernels: 6.0–6.8, 6.9-rc+HEAD

Help text

If selected LoadPin can allow reading files from filesystems that use dm-verity. LoadPin maintains a list of verity root digests it considers trusted. A verity backed filesystem is considered trusted if its root digest is found in the list of trusted digests.

The list of trusted verity can be populated through an ioctl on the LoadPin securityfs entry 'dm-verity'. The ioctl expects a file descriptor of a file with verity digests as parameter. The file must be located on the pinned root and start with the line:

# LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS

This is followed by the verity digests, with one digest per line.

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: