Re: [PATCH v7 1/3] dm: Add verity helpers for LoadPin

[Mike Snitzer]

On Mon, Jun 27 2022 at 11:35P -0400,
Matthias Kaehlcke <mka@xxxxxxxxxxxx> wrote:

> LoadPin limits loading of kernel modules, firmware and certain
> other files to a 'pinned' file system (typically a read-only
> rootfs). To provide more flexibility LoadPin is being extended
> to also allow loading these files from trusted dm-verity
> devices. For that purpose LoadPin can be provided with a list
> of verity root digests that it should consider as trusted.
> 
> Add a bunch of helpers to allow LoadPin to check whether a DM
> device is a trusted verity device. The new functions broadly
> fall in two categories: those that need access to verity
> internals (like the root digest), and the 'glue' between
> LoadPin and verity. The new file dm-verity-loadpin.c contains
> the glue functions.
> 
> Signed-off-by: Matthias Kaehlcke <mka@xxxxxxxxxxxx>
> Acked-by: Kees Cook <keescook@xxxxxxxxxxxx>

Acked-by: Mike Snitzer <snitzer@xxxxxxxxxx>