alistair23-linux/security/integrity/ima
Linus Torvalds f4f27d0028 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull security subsystem updates from James Morris:
 "Highlights:

   - A new LSM, "LoadPin", from Kees Cook is added, which allows forcing
     of modules and firmware to be loaded from a specific device (this
     is from ChromeOS, where the device as a whole is verified
     cryptographically via dm-verity).

     This is disabled by default but can be configured to be enabled by
     default (don't do this if you don't know what you're doing).

   - Keys: allow authentication data to be stored in an asymmetric key.
     Lots of general fixes and updates.

   - SELinux: add restrictions for loading of kernel modules via
     finit_module().  Distinguish non-init user namespace capability
     checks.  Apply execstack check on thread stacks"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (48 commits)
  LSM: LoadPin: provide enablement CONFIG
  Yama: use atomic allocations when reporting
  seccomp: Fix comment typo
  ima: add support for creating files using the mknodat syscall
  ima: fix ima_inode_post_setattr
  vfs: forbid write access when reading a file into memory
  fs: fix over-zealous use of "const"
  selinux: apply execstack check on thread stacks
  selinux: distinguish non-init user namespace capability checks
  LSM: LoadPin for kernel file loading restrictions
  fs: define a string representation of the kernel_read_file_id enumeration
  Yama: consolidate error reporting
  string_helpers: add kstrdup_quotable_file
  string_helpers: add kstrdup_quotable_cmdline
  string_helpers: add kstrdup_quotable
  selinux: check ss_initialized before revalidating an inode label
  selinux: delay inode label lookup as long as possible
  selinux: don't revalidate an inode's label when explicitly setting it
  selinux: Change bool variable name to index.
  KEYS: Add KEYCTL_DH_COMPUTE command
  ...
2016-05-19 09:21:36 -07:00
..
ima.h constify ima_d_path() 2016-03-28 00:47:52 -04:00
ima_api.c constify ima_d_path() 2016-03-28 00:47:52 -04:00
ima_appraise.c ima: add support for creating files using the mknodat syscall 2016-05-01 09:23:52 -04:00
ima_crypto.c ima: calculate the hash of a buffer using aynchronous hash(ahash) 2016-02-18 17:14:44 -05:00
ima_fs.c ima: measure and appraise the IMA policy itself 2016-02-21 09:34:22 -05:00
ima_init.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima_main.c ima: add support for creating files using the mknodat syscall 2016-05-01 09:23:52 -04:00
ima_mok.c IMA: Use the the system trusted keyrings instead of .ima_mok 2016-04-11 22:49:15 +01:00
ima_policy.c ima: fix the string representation of the LSM/IMA hook enumeration ordering 2016-05-04 18:46:00 +10:00
ima_queue.c
ima_template.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima_template_lib.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima_template_lib.h ima: wrap event related data to the new ima_event_data structure 2015-05-21 13:59:28 -04:00
Kconfig IMA: Use the the system trusted keyrings instead of .ima_mok 2016-04-11 22:49:15 +01:00
Makefile IMA: Use the the system trusted keyrings instead of .ima_mok 2016-04-11 22:49:15 +01:00