Janne Karhunen e8807eb1e6 ima: ima/lsm policy rule loading logic bug fixes ... commit 483ec26eed upstream. Keep the ima policy rules around from the beginning even if they appear invalid at the time of loading, as they may become active after an lsm policy load. However, loading a custom IMA policy with unknown LSM labels is only safe after we have transitioned from the "built-in" policy rules to a custom IMA policy. Patch also fixes the rule re-use during the lsm policy reload and makes some prints a bit more human readable. Changelog: v4: - Do not allow the initial policy load refer to non-existing lsm rules. v3: - Fix too wide policy rule matching for non-initialized LSMs v2: - Fix log prints Fixes: b169424551 ("ima: use the lsm policy update notifier") Cc: Casey Schaufler <casey@schaufler-ca.com> Reported-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Janne Karhunen <janne.karhunen@gmail.com> Signed-off-by: Konsta Karsisto <konsta.karsisto@gmail.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-05 16:43:49 +01:00
..
apparmor	apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock	2020-01-09 10:20:00 +01:00
integrity	ima: ima/lsm policy rule loading logic bug fixes	2020-03-05 16:43:49 +01:00
keys	KEYS: trusted: correctly initialize digests and fix locking issue	2019-09-25 02:43:53 +03:00
loadpin	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
lockdown	efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN	2019-10-31 09:40:21 +01:00
safesetid	LSM: SafeSetID: Stop releasing uninitialized ruleset	2019-09-17 11:27:05 -07:00
selinux	selinux: ensure we cleanup the internal AVC counters on error in avc_update()	2020-02-24 08:36:39 +01:00
smack	broken ping to ipv6 linklocal addresses on debian buster	2020-02-11 04:35:43 -08:00
tomoyo	tomoyo: Use atomic_t for statistics counter	2020-02-05 21:22:41 +00:00
yama	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
Kconfig	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00
Kconfig.hardening	meminit fix	2019-07-28 12:33:15 -07:00
Makefile	security: Add a static lockdown policy LSM	2019-08-19 21:54:15 -07:00
commoncap.c	Merge branch 'next-lsm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-07-09 12:24:21 -07:00
device_cgroup.c	docs: cgroup-v1: add it to the admin-guide book	2019-07-15 11:03:02 -03:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
lsm_audit.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00