Mimi Zohar
8db5da0b86
x86/ima: require signed kernel modules ...
Have the IMA architecture specific policy require signed kernel modules
on systems with secure boot mode enabled; and coordinate the different
signature verification methods, so only one signature is required.
Requiring appended kernel module signatures may be configured, enabled
on the boot command line, or with this patch enabled in secure boot
mode. This patch defines set_module_sig_enforced().
To coordinate between appended kernel module signatures and IMA
signatures, only define an IMA MODULE_CHECK policy rule if
CONFIG_MODULE_SIG is not enabled. A custom IMA policy may still define
and require an IMA signature.
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
2019-03-27 10:36:44 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-03-11 08:54:01 -07:00
Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-03-12 14:08:19 -07:00
kvm_config: add CONFIG_VIRTIO_MENU
2018-10-24 20:55:56 -04:00
kdb: use bool for binary state indicators
2018-12-30 08:31:52 +00:00
memblock: drop memblock_alloc_*_nopanic() variants
2019-03-12 10:04:02 -07:00
perf/core improvements and fixes:
2019-03-22 22:50:41 +01:00
kernel/gcov/gcc_3_4.c: use struct_size() in kzalloc()
2019-03-07 18:32:02 -08:00
genirq: Mark expected switch case fall-through
2019-03-23 12:32:01 +01:00
Merge branch 'for-5.1/atomic-replace' into for-linus
2019-03-05 15:56:59 +01:00
locking/lockdep: Only call init_rcu_head() after RCU has been initialized
2019-03-09 14:15:51 +01:00
treewide: add checks for the return value of memblock_alloc*()
2019-03-12 10:04:02 -07:00
fbdev changes for v5.1:
2019-03-15 14:22:59 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-03-06 07:59:36 -08:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-03-24 11:42:10 -07:00
time/jiffies: Make refined_jiffies static
2019-03-22 13:38:26 +01:00
for-5.1/block-post-20190315
2019-03-16 12:36:39 -07:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
async: Add support for queueing on specific NUMA node
2019-01-31 14:20:54 +01:00
audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL
2019-02-03 17:49:35 -05:00
audit: hide auditsc_get_stamp and audit_serial prototypes
2019-02-07 21:44:27 -05:00
audit: add syscall information to CONFIG_CHANGE records
2019-01-18 17:53:29 -05:00
audit: hand taken context to audit_kill_trees for syscall logging
2019-01-14 18:01:05 -05:00
audit: add syscall information to CONFIG_CHANGE records
2019-01-18 17:53:29 -05:00
audit: mark expected switch fall-through
2019-02-12 20:17:13 -05:00
audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL
2019-02-03 17:49:35 -05:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-10-31 08:54:14 -07:00
LSM: add SafeSetID module that gates setid calls
2019-01-25 11:22:43 -08:00
time: make adjtime compat handling available for 32 bit
2019-02-07 00:13:27 +01:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
Linux 5.0-rc5
2019-02-04 08:57:24 +01:00
kexec: export PG_offline to VMCOREINFO
2019-03-05 21:07:14 -08:00
SELinux: Remove cred security blob poisoning
2019-01-08 13:18:44 -08:00
delayacct: track delays from thrashing cache pages
2018-10-26 16:26:32 -07:00
Merge branch 'for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2019-03-07 10:11:41 -08:00
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
2018-10-31 08:54:12 -07:00
5.1 Merge Window Pull Request
2019-03-09 15:53:03 -08:00
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex: Ensure that futex address is aligned in handle_futex_death()
2019-03-22 13:05:26 +01:00
kernel/hung_task.c: Use continuously blocked time when reporting.
2019-03-07 18:31:59 -08:00
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
bpf: Add module name [bpf] to ksymbols for bpf programs
2019-01-21 17:38:56 -03:00
bpf: introduce bpf_spin_lock
2019-02-01 20:55:38 +01:00
kconfig: warn no new line at end of file
2018-12-15 17:44:35 +09:00
kcov: convert kcov.refcount to refcount_t
2019-03-07 18:32:02 -08:00
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump
2018-12-06 14:38:50 +00:00
kprobes: Search non-suffixed symbol in blacklist
2019-02-13 08:16:40 +01:00
Merge branch 'akpm' (patches from Andrew)
2019-03-06 10:31:36 -08:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm
2018-12-28 12:11:52 -08:00
x86/ima: require signed kernel modules
2019-03-27 10:36:44 -04:00
modsign: use all trusted keys to verify module signature
2018-11-07 14:41:41 +01:00
padata: clean an indentation issue, remove extraneous space
2018-11-16 14:11:04 +08:00
kernel/panic.c: taint: fix debugfs_simple_attr.cocci warnings
2019-03-07 18:31:59 -08:00
Fix failure path in alloc_pid()
2018-12-28 12:42:30 -08:00
signal: Use group_send_sig_info to kill all processes in a pid namespace
2018-09-16 16:08:25 +02:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
kernel/reboot.c: export pm_power_off_prepare
2018-09-11 16:13:24 +01:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-03-12 13:27:20 -07:00
device-dax for 5.1
2019-03-16 13:05:32 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-03-07 11:44:01 -08:00
pidfd patches for v5.1-rc1
2019-03-16 13:47:14 -07:00
cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
2019-01-30 19:27:00 +01:00
softirq: Don't skip softirq execution when softirq thread is parking
2019-02-10 21:51:39 +01:00
stackleak: Mark stackleak_track_stack() as notrace
2018-12-05 19:31:44 -08:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
Merge branch 'akpm' (patches from Andrew)
2019-03-07 19:25:37 -08:00
pidfd patches for v5.1-rc1
2019-03-16 13:47:14 -07:00
kernel/sysctl.c: define minmax conv functions in terms of non-minmax versions
2019-03-12 10:04:00 -07:00
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
Merge branches 'doc.2019.01.26a', 'fixes.2019.01.26a', 'sil.2019.01.26a', 'spdx.2019.02.09a', 'srcu.2019.01.26a' and 'torture.2019.01.26a' into HEAD
2019-02-09 08:47:52 -08:00
tracing: Replace synchronize_sched() and call_rcu_sched()
2018-11-27 09:21:41 -08:00
umh: add exit routine for UMH process
2019-01-11 18:05:40 -08:00
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
userns: also map extents in the reverse map to kernel IDs
2018-11-07 23:51:16 -06:00
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
watchdog/core: Make variables static
2019-03-22 13:40:17 +01:00
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
workqueue: Only unregister a registered lockdep key
2019-03-21 12:00:18 +01:00
psi: fix aggregation idle shut-off
2019-02-01 15:46:23 -08:00
8db5da0b86