security: introduce kernel_module_from_file hook

Now that kernel module origins can be reasoned about, provide a hook to
the LSMs to make policy decisions about the module file. This will let
Chrome OS enforce that loadable kernel modules can only come from its
read-only hash-verified root filesystem. Other LSMs can, for example,
read extended attributes for signatures, etc.

Signed-off-by: Kees Cook <[email protected]>
Acked-by: Serge E. Hallyn <[email protected]>
Acked-by: Eric Paris <[email protected]>
Acked-by: Mimi Zohar <[email protected]>
Acked-by: James Morris <[email protected]>
Signed-off-by: Rusty Russell <[email protected]>

0 files changed, 0 insertions, 0 deletions