[RFC 1/5] initramfs: Add initramfs signature checking

[Jeremy Linton <jeremy.linton@arm.com>]

Various root-level processes, configurations, and the like can exist
in the initramfs provided by the boot loader. The kernel does a
reasonable job of signature checking and blocking unsigned code from
running in the kernel, but this is only one aspect of system
security. The remaining init and early startup code running in
userspace are just as critical to system security.

This option provides a basic initramfs signature check, which reuses
the module signature checking infrastructure to validate the boot
loader provided initramfs. Later, a system policy can allow or deny
images that fail the signature check.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
---
 usr/Kconfig | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/usr/Kconfig b/usr/Kconfig
index 9279a2893ab0..a9c0dc0112eb 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -32,6 +32,15 @@ config INITRAMFS_FORCE
 	  and is useful if you cannot or don't want to change the image
 	  your bootloader passes to the kernel.
 
+config INITRAMFS_SIG
+	bool "Validate signed initramfs images"
+	depends on SYSTEM_DATA_VERIFICATION
+	help
+	  This option validates that image provided by the
+	  bootloader is signed. The decision to accept or
+	  reject the image is then left to the kernel lockdown
+	  logic.
+
 config INITRAMFS_ROOT_UID
 	int "User ID to map to 0 (user root)"
 	depends on INITRAMFS_SOURCE!=""
-- 
2.46.0