linux-kernel - [GIT PULL] integrity: subsystem updates for v6.19

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <58c716aa7e18d107590f98705c29e5a0434cbcbf.camel@linux.ibm.com>
Date: Tue, 02 Dec 2025 16:55:12 -0500
From: Mimi Zohar <zohar@...ux.ibm.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-integrity <linux-integrity@...r.kernel.org>,
        linux-kernel	
 <linux-kernel@...r.kernel.org>,
        Roberto Sassu
 <roberto.sassu@...weicloud.com>
Subject: [GIT PULL] integrity: subsystem updates for v6.19

Hi Linus,

There are two bug fixes: defer credentials checking from the bprm_check_security
hook to the bprm_creds_from_file security hook, properly ignore IMA policy rules
based on undefined SELinux labels.

And two IMA policy rule extensions: extend IMA to limit including file hashes in
the audit logs (dont_audit action), define a new filesystem subtype policy
option (fs_subtype).

And extend IMA to support commit b1ae6dc41eaa ("module: add in-kernel support
for decompressing") by deferring the IMA signature verification in
kernel_read_file() to after the kernel module is decompressed.

thanks,

Mimi

The following changes since commit 3a8660878839faadb4f1a6dd72c3179c1df56787:

  Linux 6.18-rc1 (2025-10-12 13:42:36 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/ tags/integrity-v6.19

for you to fetch changes up to 738c9738e690f5cea24a3ad6fd2d9a323cf614f6:

  ima: Handle error code returned by ima_filter_rule_match() (2025-11-21 07:24:01 -0500)

----------------------------------------------------------------
integrity-v6.19

----------------------------------------------------------------
Coiby Xu (1):
      ima: Access decompressed kernel module to verify appended signature

Jann Horn (2):
      ima: add dont_audit action to suppress audit actions
      ima: add fs_subtype condition for distinguishing FUSE instances

Roberto Sassu (1):
      ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook

Zhao Yipeng (1):
      ima: Handle error code returned by ima_filter_rule_match()

 Documentation/ABI/testing/ima_policy |  3 +-
 include/linux/kernel_read_file.h     |  1 +
 kernel/module/main.c                 | 17 ++++++++--
 security/integrity/ima/ima_main.c    | 62 +++++++++++++++++++++++++++---------
 security/integrity/ima/ima_policy.c  | 62 ++++++++++++++++++++++++++++++++----
 security/ipe/hooks.c                 |  1 +
 security/selinux/hooks.c             |  5 +--
 7 files changed, 123 insertions(+), 28 deletions(-)