Re: [RFC PATCH v2] loadpin: allow untoggleable enforcement on filesystems which don't appear to be read-only

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] loadpin: missing kernel-parameters.txt entry for loadpin.force_enforce
--

commit 3c1a61d7c88964a1454aaa2bc83f65dd49fd3e65
Author: Amelia Crate <acrate@waldn.net>

loadpin: allow untoggleable enforcement on filesystems which don't appear to be read-only

This patch adds a loadpin.force_enforce kernel parameter and corresponding
read-only sysctl to enforce LoadPin and prevent toggling enforcement even
when the backing filesystem does not appear to be read-only.

> diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
> index f71861f98e1ab..0014f78799b21 100644
> --- a/security/loadpin/loadpin.c
> +++ b/security/loadpin/loadpin.c

[ ... ]

> @@ -436,6 +454,8 @@ DEFINE_LSM(loadpin) = {
>  };
>  
>  /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
> +module_param(force_enforce, bool, 0);
> +MODULE_PARM_DESC(force_enforce, "Always enforce module/firmware pinning");

[Severity: Low]
This adds the loadpin.force_enforce boot parameter via module_param() in
security/loadpin/loadpin.c and documents it in
Documentation/admin-guide/LSM/LoadPin.rst, but omits an entry in
Documentation/admin-guide/kernel-parameters.txt.

Should loadpin.force_enforce also be documented in
Documentation/admin-guide/kernel-parameters.txt?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029151432.27642-1-acrate@waldn.net?part=1