Linus Torvalds 1a35914f73 integrity-v6.6 ... -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCZO0WoxQcem9oYXJAbGlu dXguaWJtLmNvbQAKCRDLwZzRsCrn5alsAP0UZQIKI2zEjFdtucgClcSouflIOC5i Hvtgv3qVFXPZQwEA2H/SGjigtH5NruVXECDZdrIfaGGvBhyeY72lbswXfQ0= =Gu8i -----END PGP SIGNATURE----- Merge tag 'integrity-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity subsystem updates from Mimi Zohar: - With commit 099f26f22f ("integrity: machine keyring CA configuration") certificates may be loaded onto the IMA keyring, directly or indirectly signed by keys on either the "builtin" or the "machine" keyrings. With the ability for the system/machine owner to sign the IMA policy itself without needing to recompile the kernel, update the IMA architecture specific policy rules to require the IMA policy itself be signed. [ As commit 099f26f22f was upstreamed in linux-6.4, updating the IMA architecture specific policy now to require signed IMA policies may break userspace expectations. ] - IMA only checked the file data hash was not on the system blacklist keyring for files with an appended signature (e.g. kernel modules, Power kernel image). Check all file data hashes regardless of how it was signed - Code cleanup, and a kernel-doc update * tag 'integrity-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: kexec_lock: Replace kexec_mutex() by kexec_lock() in two comments ima: require signed IMA policy when UEFI secure boot is enabled integrity: Always reference the blacklist keyring with appraisal ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig		2023-08-30 09:16:56 -07:00
..
ima_api.c	integrity-v6.5	2023-06-27 17:32:34 -07:00
ima_appraise.c	integrity: Always reference the blacklist keyring with appraisal	2023-08-01 08:17:25 -04:00
ima_asymmetric_keys.c	fs: port xattr to mnt_idmap	2023-01-19 09:24:28 +01:00
ima_crypto.c	mm, treewide: redefine MAX_ORDER sanely	2023-04-05 19:42:46 -07:00
ima_efi.c	ima: require signed IMA policy when UEFI secure boot is enabled	2023-08-01 08:18:11 -04:00
ima_fs.c	ima: Return error code obtained from securityfs functions	2022-02-15 11:17:01 -05:00
ima_init.c	ima: define ima_max_digest_data struct without a flexible array variable	2022-02-15 11:52:06 -05:00
ima_kexec.c	kexec_lock: Replace kexec_mutex() by kexec_lock() in two comments	2023-08-07 09:55:42 -04:00
ima_main.c	IMA: use vfs_getattr_nosec to get the i_version	2023-05-23 18:07:34 -04:00
ima_modsig.c	ima: Fix build warnings	2023-06-06 09:37:23 -04:00
ima_mok.c	IMA: remove -Wmissing-prototypes warning	2021-07-23 08:05:06 -04:00
ima_policy.c	integrity-v6.6	2023-08-30 09:16:56 -07:00
ima_queue_keys.c	fs: port xattr to mnt_idmap	2023-01-19 09:24:28 +01:00
ima_queue.c	IMA: support for duplicate measurement records	2021-06-11 12:54:13 -04:00
ima_template_lib.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ima_template_lib.h	ima: define a new template field named 'd-ngv2' and templates	2022-05-05 11:49:13 -04:00
ima_template.c	ima: Fix misuse of dereference of pointer in template_desc_init_fields()	2022-11-16 11:47:55 -05:00
ima.h	integrity-v6.3	2023-02-22 12:36:25 -08:00
Kconfig	integrity-v6.6	2023-08-30 09:16:56 -07:00
Makefile	ima: generalize x86/EFI arch glue for other EFI architectures	2020-11-06 07:40:42 +01:00