Enhance file integrity check to perform verification during system bootup 7.0.15

This enhancement improves upon previous BIOS-level and real-time file integrity checks by requiring the kernel to verify the signed hashes of important file-system and object files during bootup. This prevents unauthorized changes to file-systems to be mounted and other unauthorized objects to be loaded into user space on bootup.

This verification does not depend on the security level of the device. The verification will always run when the firmware image type is a GA, SA, Beta, or Top3 image. If the signed hash verification fails, the system will halt during bootup.

This enhancement supplements previous security measures to validate the firmware, AV, and IPS packages in the BIOS (see Enhance BIOS-level signature and file integrity checking 7.0.12), as well as performing real-time binary and executable integrity checks in user space (see Real-time file system integrity checking 7.0.12).

For more information about this feature, see Enhance file integrity check to perform verification during system bootup.