diff options
| author | Kees Cook <[email protected]> | 2012-10-16 07:32:07 +1030 |
|---|---|---|
| committer | Rusty Russell <[email protected]> | 2012-12-14 13:05:24 +1030 |
| commit | 2e72d51b4ac32989496870cd8171b3682fea1839 (patch) | |
| tree | b8190d17aa5d59508f8c979ce0160f21bef89500 /lib/pm-notifier-error-inject.c | |
| parent | 2f3238aebedb243804f58d62d57244edec4149b2 (diff) | |
security: introduce kernel_module_from_file hook
Now that kernel module origins can be reasoned about, provide a hook to
the LSMs to make policy decisions about the module file. This will let
Chrome OS enforce that loadable kernel modules can only come from its
read-only hash-verified root filesystem. Other LSMs can, for example,
read extended attributes for signatures, etc.
Signed-off-by: Kees Cook <[email protected]>
Acked-by: Serge E. Hallyn <[email protected]>
Acked-by: Eric Paris <[email protected]>
Acked-by: Mimi Zohar <[email protected]>
Acked-by: James Morris <[email protected]>
Signed-off-by: Rusty Russell <[email protected]>
Diffstat (limited to 'lib/pm-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions