Changes in Makefile

9cdca336677b4d15579ec462e33c8a330ab3a9de - Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Sat, 18 Apr 2026 00:42:01 +0200

Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrityPull integrity updates from Mimi Zohar: "There are two main changes, one feature removal, some code cleanup, and a number of bug fixes. Main changes: - Detecting secure boot mode was limited to IMA. Make detecting secure boot mode accessible to EVM and other LSMs - IMA sigv3 support was limited to fsverity. Add IMA sigv3 support for IMA regular file hashes and EVM portable signatures Remove: - Remove IMA support for asychronous hash calculation originally added for hardware acceleration Cleanup: - Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG tests - Add descriptions of the IMA atomic flags Bug fixes: - Like IMA, properly limit EVM "fix" mode - Define and call evm_fix_hmac() to update security.evm - Fallback to using i_version to detect file change for filesystems that do not support STATX_CHANGE_COOKIE - Address missing kernel support for configured (new) TPM hash algorithms - Add missing crypto_shash_final() return value"* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: evm: Enforce signatures version 3 with new EVM policy 'bit 3' integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG ima: add support to require IMA sigv3 signatures ima: add regular file data hash signature version 3 support ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures ima: remove buggy support for asynchronous hashes integrity: Eliminate weak definition of arch_get_secureboot() ima: Add code comments to explain IMA iint cache atomic_flags ima_fs: Correctly create securityfs files for unsupported hash algos ima: check return value of crypto_shash_final() in boot aggregate ima: Define and use a digest_size field in the ima_algo_desc structure powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG ima: fallback to using i_version to detect file change evm: fix security.evm for a file with IMA signature s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT evm: Don't enable fix mode when secure boot is enabled integrity: Make arch_ima_get_secureboot integrity-wide List of files: /linux/security/integrity/Makefile

7caedbb5ade345df0eec0bf01035c780919a9f56 - integrity: Eliminate weak definition of arch_get_secureboot()

Mon, 09 Mar 2026 21:37:02 +0100

integrity: Eliminate weak definition of arch_get_secureboot()security/integrity/secure_boot.c contains a single __weak function,which breaks recordmcount when building with clang: $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64_defconfig security/integrity/secure_boot.o Cannot find symbol for section 2: .text. security/integrity/secure_boot.o: failedIntroduce a Kconfig symbol, CONFIG_HAVE_ARCH_GET_SECUREBOOT, to indicatethat an architecture provides a definition of arch_get_secureboot().Provide a static inline stub when this symbol is not defined to achievethe same effect as the __weak function, allowing secure_boot.c to beremoved altogether. Move the s390 definition of arch_get_secureboot()out of the CONFIG_KEXEC_FILE block to ensure it is always available, asit does not actually depend on KEXEC_FILE.Reported-by: Arnd Bergmann Fixes: 31a6a07eefeb ("integrity: Make arch_ima_get_secureboot integrity-wide")Signed-off-by: Nathan Chancellor Acked-by: Arnd Bergmann Signed-off-by: Mimi Zohar List of files: /linux/security/integrity/Makefile

31a6a07eefeb4c84bd6730fbe9e95fd9221712cf - integrity: Make arch_ima_get_secureboot integrity-wide

Fri, 13 Feb 2026 02:28:46 +0100

integrity: Make arch_ima_get_secureboot integrity-wideEVM and other LSMs need the ability to query the secure boot status ofthe system, without directly calling the IMA arch_ima_get_securebootfunction. Refactor the secure boot status check into a general functionnamed arch_get_secureboot.Reported-and-suggested-by: Mimi Zohar Suggested-by: Roberto Sassu Signed-off-by: Coiby Xu Acked-by: Ard Biesheuvel Signed-off-by: Mimi Zohar List of files: /linux/security/integrity/Makefile

a23e1966932464e1c5226cb9ac4ce1d5fc10ba22 - Merge branch 'next' into for-linus

Mon, 15 Jul 2024 23:03:44 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.11 merge window. List of files: /linux/security/integrity/Makefile

6f47c7ae8c7afaf9ad291d39f0d3974f191a7946 - Merge tag 'v6.9' into next

Tue, 28 May 2024 06:37:18 +0200

Merge tag 'v6.9' into nextSync up with the mainline to bring in the new cleanup API. List of files: /linux/security/integrity/Makefile

60a2f25de7b8b785baee2932db932ae9a5b8c86d - Merge drm/drm-next into drm-intel-gt-next

Thu, 16 May 2024 09:33:01 +0200

Merge drm/drm-next into drm-intel-gt-nextSome display refactoring patches are needed in order to allow conflict-less merging.Signed-off-by: Tvrtko Ursulin List of files: /linux/security/integrity/Makefile

594ce0b8a998aa4d05827cd7c0d0dcec9a1e3ae2 - Merge topic branches 'clkdev' and 'fixes' into for-linus

Mon, 10 Jun 2024 13:03:21 +0200

Merge topic branches 'clkdev' and 'fixes' into for-linus List of files: /linux/security/integrity/Makefile

b228ab57e51b62663a80ca820c87ba2650583f08 - Merge branch 'master' into mm-stable

Mon, 18 Mar 2024 17:55:12 +0100

Merge branch 'master' into mm-stable List of files: /linux/security/integrity/Makefile

79790b6818e96c58fe2bffee1b418c16e64e7b80 - Merge drm/drm-next into drm-xe-next

Fri, 12 Apr 2024 15:14:25 +0200

Merge drm/drm-next into drm-xe-nextBackmerging drm-next in order to get up-to-date and in particularto access commit 9ca5facd0400f610f3f7f71aeb7fc0b949a48c67.Signed-off-by: Thomas Hellström List of files: /linux/security/integrity/Makefile

3e5a516f3bf1a33f2bf219f570e9b5c031616f6a - Merge tag 'phy_dp_modes_6.10' into msm-next-lumag

Mon, 08 Apr 2024 17:35:51 +0200

Merge tag 'phy_dp_modes_6.10' into msm-next-lumagMerge DisplayPort subnode API in order to allow DisplayPort driver toconfigure the PHYs either to the DP or eDP mode, depending on hardwareconfiguration.Signed-off-by: Dmitry Baryshkov List of files: /linux/security/integrity/Makefile

5add703f6acad1c63f8a532b6de56e50d548e904 - Merge drm/drm-next into drm-intel-next

Tue, 02 Apr 2024 14:17:13 +0200

Merge drm/drm-next into drm-intel-nextCatching up on 6.9-rc2Signed-off-by: Rodrigo Vivi List of files: /linux/security/integrity/Makefile

0d21364c6e8dc1f62c34bbc49d49935c8b01844c - Merge drm/drm-next into drm-misc-next

Tue, 02 Apr 2024 09:51:30 +0200

Merge drm/drm-next into drm-misc-nextBackmerging to get v6.9-rc2 changes into drm-misc-next.Signed-off-by: Thomas Zimmermann List of files: /linux/security/integrity/Makefile

b7e1e969c887c897947fdc3754fe9b0c24acb155 - Merge branch 'topic/sound-devel-6.10' into for-next

Tue, 26 Mar 2024 12:19:11 +0100

Merge branch 'topic/sound-devel-6.10' into for-next List of files: /linux/security/integrity/Makefile

537c2e91d3549e5d6020bb0576cf9b54a845255f - Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Fri, 22 Mar 2024 00:14:13 +0100

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netCross-merge networking fixes after downstream PR.Signed-off-by: Jakub Kicinski List of files: /linux/security/integrity/Makefile

f4566a1e73957800df75a3dd2dccee8a4697f327 - Merge tag 'v6.9-rc1' into sched/core, to pick up fixes and to refresh the branch

Mon, 25 Mar 2024 11:32:29 +0100

Merge tag 'v6.9-rc1' into sched/core, to pick up fixes and to refresh the branchSigned-off-by: Ingo Molnar List of files: /linux/security/integrity/Makefile

100c85421b52e41269ada88f7d71a6b8a06c7a11 - Merge tag 'asoc-fix-v6.9-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Fri, 05 Apr 2024 08:48:12 +0200

Merge tag 'asoc-fix-v6.9-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.9A relatively large set of fixes here, the biggest piece of it is aseries correcting some problems with the delay reporting for Intel SOFcards but there's a bunch of other things. Everything here is driverspecific except for a fix in the core for an issue with sign extensionhandling volume controls. List of files: /linux/security/integrity/Makefile

36a1818f5a1e50b805317ba13f827067d50f6970 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 25 Mar 2024 21:11:58 +0100

Merge drm/drm-fixes into drm-misc-fixesBackmerging to get drm-misc-fixes to the state of v6.9-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/security/integrity/Makefile

cc4a875cf3b3bc07d523ea85b8ca45da1ca4f4e6 - Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Wed, 13 Mar 2024 04:03:34 +0100

Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsmPull lsm updates from Paul Moore: - Promote IMA/EVM to a proper LSM This is the bulk of the diffstat, and the source of all the changes in the VFS code. Prior to the start of the LSM stacking work it was important that IMA/EVM were separate from the rest of the LSMs, complete with their own hooks, infrastructure, etc. as it was the only way to enable IMA/EVM at the same time as a LSM. However, now that the bulk of the LSM infrastructure supports multiple simultaneous LSMs, we can simplify things greatly by bringing IMA/EVM into the LSM infrastructure as proper LSMs. This is something I've wanted to see happen for quite some time and Roberto was kind enough to put in the work to make it happen. - Use the LSM hook default values to simplify the call_int_hook() macro Previously the call_int_hook() macro required callers to supply a default return value, despite a default value being specified when the LSM hook was defined. This simplifies the macro by using the defined default return value which makes life easier for callers and should also reduce the number of return value bugs in the future (we've had a few pop up recently, hence this work). - Use the KMEM_CACHE() macro instead of kmem_cache_create() The guidance appears to be to use the KMEM_CACHE() macro when possible and there is no reason why we can't use the macro, so let's use it. - Fix a number of comment typos in the LSM hook comment blocks Not much to say here, we fixed some questionable grammar decisions in the LSM hook comment blocks.* tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (28 commits) cred: Use KMEM_CACHE() instead of kmem_cache_create() lsm: use default hook return value in call_int_hook() lsm: fix typos in security/security.c comment headers integrity: Remove LSM ima: Make it independent from 'integrity' LSM evm: Make it independent from 'integrity' LSM evm: Move to LSM infrastructure ima: Move IMA-Appraisal to LSM infrastructure ima: Move to LSM infrastructure integrity: Move integrity_kernel_module_request() to IMA security: Introduce key_post_create_or_update hook security: Introduce inode_post_remove_acl hook security: Introduce inode_post_set_acl hook security: Introduce inode_post_create_tmpfile hook security: Introduce path_post_mknod hook security: Introduce file_release hook security: Introduce file_post_open hook security: Introduce inode_post_removexattr hook security: Introduce inode_post_setattr hook security: Align inode_setattr hook definition with EVM ... List of files: /linux/security/integrity/Makefile

cd3cec0a02c7338ce2901c574f3935b8f6984aab - ima: Move to LSM infrastructure

Thu, 15 Feb 2024 11:31:08 +0100

ima: Move to LSM infrastructureMove hardcoded IMA function calls (not appraisal-specific functions) fromvarious places in the kernel to the LSM infrastructure, by introducing anew LSM named 'ima' (at the end of the LSM list and always enabled like'integrity').Having IMA before EVM in the Makefile is sufficient to preserve therelative order of the new 'ima' LSM in respect to the upcoming 'evm' LSM,and thus the order of IMA and EVM function calls as when they werehardcoded.Make moved functions as static (except ima_post_key_create_or_update(),which is not in ima_main.c), and register them as implementation of therespective hooks in the new function init_ima_lsm().Select CONFIG_SECURITY_PATH, to ensure that the path-based LSM hookpath_post_mknod is always available and ima_post_path_mknod() is alwaysexecuted to mark files as new, as before the move.A slight difference is that IMA and EVM functions registered for theinode_post_setattr, inode_post_removexattr, path_post_mknod,inode_post_create_tmpfile, inode_post_set_acl and inode_post_remove_aclwon't be executed for private inodes. Since those inodes are supposed to befs-internal, they should not be of interest to IMA or EVM. The S_PRIVATEflag is used for anonymous inodes, hugetlbfs, reiserfs xattrs, XFS scruband kernel-internal tmpfs files.Conditionally register ima_post_key_create_or_update() ifCONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is enabled. Also, conditionally registerima_kernel_module_request() if CONFIG_INTEGRITY_ASYMMETRIC_KEYS is enabled.Finally, add the LSM_ID_IMA case in lsm_list_modules_test.c.Signed-off-by: Roberto Sassu Acked-by: Chuck Lever Acked-by: Casey Schaufler Acked-by: Christian Brauner Reviewed-by: Stefan Berger Reviewed-by: Mimi Zohar Acked-by: Mimi Zohar Signed-off-by: Paul Moore List of files: /linux/security/integrity/Makefile

4f2c0a4acffbec01079c28f839422e64ddeff004 - Merge branch 'main' into zstd-linus

Wed, 14 Dec 2022 01:21:55 +0100

Merge branch 'main' into zstd-linus List of files: /linux/security/integrity/Makefile