Matthias Kaehlcke 6e42aec7c7 LoadPin: Require file with verity root digests to have a header ... LoadPin expects the file with trusted verity root digests to be an ASCII file with one digest (hex value) per line. A pinned root could contain files that meet these format requirements, even though the hex values don't represent trusted root digests. Add a new requirement to the file format which consists in the first line containing a fixed string. This prevents attackers from feeding files with an otherwise valid format to LoadPin. Suggested-by: Sarthak Kukreti <sarthakkukreti@chromium.org> Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220906181725.1.I3f51d1bb0014e5a5951be4ad3c5ad7c7ca1dfc32@changeid		2022-09-07 16:37:27 -07:00
..
Kconfig	LoadPin: Require file with verity root digests to have a header	2022-09-07 16:37:27 -07:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
loadpin.c	LoadPin: Require file with verity root digests to have a header	2022-09-07 16:37:27 -07:00