Re: [PATCH v3] Allow to exclude specific file types in LoadPin

2019-05-31 Thread Kees Cook
On Fri, May 31, 2019 at 11:25:53AM -0700, Ke Wu wrote: > Linux kernel already provide MODULE_SIG and KEXEC_VERIFY_SIG to > make sure loaded kernel module and kernel image are trusted. This > patch adds a kernel command line option "loadpin.exclude" which > allows to exclude specific file types from

[PATCH v3] Allow to exclude specific file types in LoadPin

2019-05-31 Thread Ke Wu
Linux kernel already provide MODULE_SIG and KEXEC_VERIFY_SIG to make sure loaded kernel module and kernel image are trusted. This patch adds a kernel command line option "loadpin.exclude" which allows to exclude specific file types from LoadPin. This is useful when people want to use different mech