11 lines
515 B
Plaintext
11 lines
515 B
Plaintext
config SECURITY_LOADPIN
|
|
bool "Pin load of kernel files (modules, fw, etc) to one filesystem"
|
|
depends on SECURITY && BLOCK
|
|
help
|
|
Any files read through the kernel file reading interface
|
|
(kernel modules, firmware, kexec images, security policy) will
|
|
be pinned to the first filesystem used for loading. Any files
|
|
that come from other filesystems will be rejected. This is best
|
|
used on systems without an initrd that have a root filesystem
|
|
backed by a read-only device such as dm-verity or a CDROM.
|