diff options
| author | Fan Wu <wufan@linux.microsoft.com> | 2024-08-02 23:08:19 -0700 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 14:01:41 -0400 |
| commit | 2fea0c26b82f304f43b3905e56d954cf98a6d0e9 (patch) | |
| tree | 75d2e25539d522736a0fa0d878ee67cae2f7cb8e /include/linux/lsm_hook_defs.h | |
| parent | 52443cb60c356707df494910fa134bbb0a8b1a66 (diff) | |
| download | linux-2fea0c26b82f304f43b3905e56d954cf98a6d0e9.tar.gz linux-2fea0c26b82f304f43b3905e56d954cf98a6d0e9.tar.bz2 linux-2fea0c26b82f304f43b3905e56d954cf98a6d0e9.zip | |
initramfs,lsm: add a security hook to do_populate_rootfs()
This patch introduces a new hook to notify security system that the
content of initramfs has been unpacked into the rootfs.
Upon receiving this notification, the security system can activate
a policy to allow only files that originated from the initramfs to
execute or load into kernel during the early stages of booting.
This approach is crucial for minimizing the attack surface by
ensuring that only trusted files from the initramfs are operational
in the critical boot phase.
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/linux/lsm_hook_defs.h')
| -rw-r--r-- | include/linux/lsm_hook_defs.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 520730fe2d94..22a14fc794fe 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -449,3 +449,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new) LSM_HOOK(int, 0, uring_sqpoll, void) LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) #endif /* CONFIG_IO_URING */ + +LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void) |