From: Stephen Boyd Date: Tue, 14 May 2024 22:48:38 +0000 (-0700) Subject: loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=ce0d73ef8dea52d7253bdc2fd3cc3e89d7089ded;p=linux.git loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression If modules are built compressed, and LoadPin is enforcing by default, we must have in-kernel module decompression enabled (MODULE_DECOMPRESS). Modules will fail to load without decompression built into the kernel because they'll be blocked by LoadPin. Add a depends on clause to prevent this combination. Cc: Dmitry Torokhov Cc: Douglas Anderson Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20240514224839.2526112-1-swboyd@chromium.org Signed-off-by: Kees Cook --- diff --git a/security/loadpin/Kconfig b/security/loadpin/Kconfig index 6724eaba3d364..848f8b4a60190 100644 --- a/security/loadpin/Kconfig +++ b/security/loadpin/Kconfig @@ -14,6 +14,9 @@ config SECURITY_LOADPIN config SECURITY_LOADPIN_ENFORCE bool "Enforce LoadPin at boot" depends on SECURITY_LOADPIN + # Module compression breaks LoadPin unless modules are decompressed in + # the kernel. + depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS) help If selected, LoadPin will enforce pinning at boot. If not selected, it can be enabled at boot with the kernel parameter