Changes in ima_policy

546b928da0427b0d6c663cbb992bd7bfa9ac7971 - Merge tag 'asoc-fix-v7.3-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Thu, 17 Sep 2026 08:15:32 +0200

Merge tag 'asoc-fix-v7.3-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v7.3A relatively large pile of fixes here, a lot of driver specific stuffthat's broadly unremarkable plus a few core fixes from Richard that fixissues where SoundWire systems with multiple CODECs on the same linkwould configure the CODECs to use the same bus slots leading to brokenaudio. List of files: /linux/Documentation/ABI/testing/ima_policy

a8916759a451918c2a95633390d3428640858087 - Merge drm/drm-fixes into drm-misc-fixes

Tue, 08 Sep 2026 13:32:08 +0200

Merge drm/drm-fixes into drm-misc-fixesBackmerging to get drm-misc-fixes up to v7.3-rc2.Signed-off-by: Thomas Zimmermann List of files: /linux/Documentation/ABI/testing/ima_policy

4d7d9486c04d917265f64c55bd23b2cc4fe7749c - Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Sat, 05 Sep 2026 04:36:11 +0200

Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrityPull IMA fixes from Mimi Zohar: - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks resulted in configfs locking issues. configfs files should not be measured, appraised, or audited in the first place, so the builtin policies are updated to exclude them. - IMA audit messages include the filename, which could result in a page fault when the filename doesn't exist - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() ima: don't measure/appraise files on configfs configfs: move CONFIGFS_MAGIC definition to magic.h List of files: /linux/Documentation/ABI/testing/ima_policy

8e22ce504f8a332c57ca9676ab804da5ac4a1325 - ima: don't measure/appraise files on configfs

Thu, 20 Aug 2026 01:45:23 +0200

ima: don't measure/appraise files on configfsIMA measurement of a configfs file causes process_measurement() to holdiint->mutex while performing a kernel_read() to hash it, which re-entersconfigfs's own file locking (buffer->mutex, frag_sem).Separately, opening any file with O_TRUNC now causes ima_file_truncate()to take iint->mutex to reset the cached action flags, while sb_writers isalready held for that mount.When a configfs-backed nvmet namespace is involved, these two independentlock chains combine into a cycle:iint->mutex -> configfs locks -> subsys->lock -> sb_writers -> iint->mutexAdd configfs to the builtin don't measure/appraise rules, similarly toother pseudo file systems, so IMA never takes iint->mutex for configfsfile in the first place.Reported-by: syzbot+448c2e24b1ceff13ed2a@syzkaller.appspotmail.comLink: https://lore.kernel.org/all/6a77c7cd.b50370da.49fe0.0031.GAE@google.com/Suggested-by: Mimi Zohar Signed-off-by: Frederick Lawler Signed-off-by: Mimi Zohar List of files: /linux/Documentation/ABI/testing/ima_policy

7a0e692a0381254b2f77c54dec100cd3325a6fdf - Merge branch 'next' into for-linus

Tue, 23 Jun 2026 08:10:08 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.2 merge window. List of files: /linux/Documentation/ABI/testing/ima_policy

aa776949fb77462ee712eee28bc54a9ce95c5b40 - Merge branch 'for-7.2/wiimote' into for-linus

Tue, 16 Jun 2026 21:47:16 +0200

Merge branch 'for-7.2/wiimote' into for-linus List of files: /linux/Documentation/ABI/testing/ima_policy

fff88709f9a9153af85b5224b4594caa5387ca60 - Merge tag 'v7.1-rc6' into next

Mon, 01 Jun 2026 04:43:25 +0200

Merge tag 'v7.1-rc6' into nextSync up with mainline to pull in a fix to IMS PCU driver and otherenhancements. List of files: /linux/Documentation/ABI/testing/ima_policy

639609b83f69fe4cd08e01423ae8e12d84484cfa - Merge branch 'arena_direct_access' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.2

Mon, 25 May 2026 21:34:24 +0200

Merge branch 'arena_direct_access' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.2 List of files: /linux/Documentation/ABI/testing/ima_policy

5c8cbca290acdd49a694b36c0af76ba0c00bbf12 - Merge branch '20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into HEAD

Thu, 21 May 2026 22:36:50 +0200

Merge branch '20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into HEADMerge the branch with the soc/qcom changes, required for the next UBWCpatches.Signed-off-by: Dmitry Baryshkov List of files: /linux/Documentation/ABI/testing/ima_policy

09d6818d3bdc1ea6e49a425040528cbdbc97bc0a - Merge branch 'linus' into timers/clocksource

Mon, 18 May 2026 11:01:07 +0200

Merge branch 'linus' into timers/clocksource... to bring it up to date for new changes. List of files: /linux/Documentation/ABI/testing/ima_policy

658a6021492ad3b1b8a6e9a83963a1fad35a2af8 - Merge drm/drm-next into drm-intel-next

Fri, 15 May 2026 13:01:15 +0200

Merge drm/drm-next into drm-intel-nextSome Display Port Adaptive Sync depends on drm work.Signed-off-by: Rodrigo Vivi List of files: /linux/Documentation/ABI/testing/ima_policy

8edf8b09fc44990977b3fbcb708035b1740d0b7e - Merge drm/drm-next into drm-intel-gt-next

Tue, 12 May 2026 10:16:35 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerging to pull in commit 5401b9adebc9 ("i915: don't usea vma that didn't match the context VM") to revert it.Signed-off-by: Joonas Lahtinen List of files: /linux/Documentation/ABI/testing/ima_policy

c53ed3e99920df6a90553c89a1c053aa0776841e - Merge drm/drm-next into drm-xe-next

Fri, 08 May 2026 16:19:45 +0200

Merge drm/drm-next into drm-xe-nextBringing in recent display changes.Signed-off-by: Thomas Hellström List of files: /linux/Documentation/ABI/testing/ima_policy

cafac16b6207b88ad92fbba1169ae4f43865cb0d - Merge drm/drm-next into drm-misc-next

Mon, 27 Apr 2026 10:49:13 +0200

Merge drm/drm-next into drm-misc-nextGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/Documentation/ABI/testing/ima_policy

9c9fe04e0fe3fdba7d4aafffa9b7bbb21f6fcbe1 - Merge tag 'v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next

Mon, 27 Apr 2026 09:39:48 +0200

Merge tag 'v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-nextLinux 7.1-rc1 List of files: /linux/Documentation/ABI/testing/ima_policy

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/Documentation/ABI/testing/ima_policy

f4b369c6fe0ceaba2da2daff8c9eb415f85926dd - Merge branch 'next' into for-linus

Mon, 20 Apr 2026 03:28:57 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.1 merge window. List of files: /linux/Documentation/ABI/testing/ima_policy

0421ccdfad0d92713a812a5aeb7d07b0ea7213c8 - Merge tag 'v7.0-rc3' into next

Thu, 12 Mar 2026 18:44:42 +0100

Merge tag 'v7.0-rc3' into nextSync up with the mainline to brig up the latest changes, specificallychanges to ALPS driver. List of files: /linux/Documentation/ABI/testing/ima_policy

9cdca336677b4d15579ec462e33c8a330ab3a9de - Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Sat, 18 Apr 2026 00:42:01 +0200

Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrityPull integrity updates from Mimi Zohar: "There are two main changes, one feature removal, some code cleanup, and a number of bug fixes. Main changes: - Detecting secure boot mode was limited to IMA. Make detecting secure boot mode accessible to EVM and other LSMs - IMA sigv3 support was limited to fsverity. Add IMA sigv3 support for IMA regular file hashes and EVM portable signatures Remove: - Remove IMA support for asychronous hash calculation originally added for hardware acceleration Cleanup: - Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG tests - Add descriptions of the IMA atomic flags Bug fixes: - Like IMA, properly limit EVM "fix" mode - Define and call evm_fix_hmac() to update security.evm - Fallback to using i_version to detect file change for filesystems that do not support STATX_CHANGE_COOKIE - Address missing kernel support for configured (new) TPM hash algorithms - Add missing crypto_shash_final() return value"* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: evm: Enforce signatures version 3 with new EVM policy 'bit 3' integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG ima: add support to require IMA sigv3 signatures ima: add regular file data hash signature version 3 support ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures ima: remove buggy support for asynchronous hashes integrity: Eliminate weak definition of arch_get_secureboot() ima: Add code comments to explain IMA iint cache atomic_flags ima_fs: Correctly create securityfs files for unsupported hash algos ima: check return value of crypto_shash_final() in boot aggregate ima: Define and use a digest_size field in the ima_algo_desc structure powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG ima: fallback to using i_version to detect file change evm: fix security.evm for a file with IMA signature s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT evm: Don't enable fix mode when secure boot is enabled integrity: Make arch_ima_get_secureboot integrity-wide List of files: /linux/Documentation/ABI/testing/ima_policy

de4c44a7f559ceae19f7a70febf49e87bdfb125c - ima: add support to require IMA sigv3 signatures

Tue, 10 Mar 2026 14:16:25 +0100

ima: add support to require IMA sigv3 signaturesDefining a policy rule with the "appraise_type=imasig" option allowseither v2 or v3 signatures. Defining an IMA appraise rule with the"appraise_type=sigv3" option requires a file sigv3 signature.Define a new appraise type: IMA_SIGV3_REQUIREDExample: appraise func=BPRM_CHECK appraise_type=sigv3Tested-by: Stefan Berger Acked-by: Eric Biggers Signed-off-by: Mimi Zohar List of files: /linux/Documentation/ABI/testing/ima_policy