• Linus Torvalds's avatar
    Merge branch 'next-integrity' of... · f218a29c
    Linus Torvalds authored
    Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
    Pull integrity updates from James Morris:
     "In Linux 4.19, a new LSM hook named security_kernel_load_data was
      upstreamed, allowing LSMs and IMA to prevent the kexec_load syscall.
      Different signature verification methods exist for verifying the
      kexec'ed kernel image. This adds additional support in IMA to prevent
      loading unsigned kernel images via the kexec_load syscall,
      independently of the IMA policy rules, based on the runtime "secure
      boot" flag. An initial IMA kselftest is included.
      In addition, this pull request defines a new, separate keyring named
      ".platform" for storing the preboot/firmware keys needed for verifying
      the kexec'ed kernel image's signature and includes the associated IMA
      kexec usage of the ".platform" keyring.
      (David Howell's and Josh Boyer's patches for reading the
      preboot/firmware keys, which were previously posted for a different
      use case scenario, are included here)"
    * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
      integrity: Remove references to module keyring
      ima: Use inode_is_open_for_write
      ima: Support platform keyring for kernel appraisal
      efi: Allow the "db" UEFI variable to be suppressed
      efi: Import certificates from UEFI Secure Boot
      efi: Add an EFI signature blob parser
      efi: Add EFI signature data types
      integrity: Load certs to the platform keyring
      integrity: Define a trusted platform keyring
      selftests/ima: kexec_load syscall test
      ima: don't measure/appraise files on efivarfs
      x86/ima: retry detecting secure boot mode
      docs: Extend trusted keys documentation for TPM 2.0
      x86/ima: define arch_get_ima_policy() for x86
      ima: add support for arch specific policies
      ima: refactor ima_init_policy()
      ima: prevent kexec_load syscall based on runtime secureboot flag
      x86/ima: define arch_ima_get_secureboot
      integrity: support new struct public_key_signature encoding field
Last commit
Last update
keys Loading commit data...
tpm Loading commit data...
IMA-templates.rst Loading commit data...
LSM-sctp.rst Loading commit data...
LSM.rst Loading commit data...
SELinux-sctp.rst Loading commit data...
credentials.rst Loading commit data...
index.rst Loading commit data...
self-protection.rst Loading commit data...