• Linus Torvalds's avatar
    Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm · cc4a875c
    Linus Torvalds authored
    Pull lsm updates from Paul Moore:
    
     - Promote IMA/EVM to a proper LSM
    
       This is the bulk of the diffstat, and the source of all the changes
       in the VFS code. Prior to the start of the LSM stacking work it was
       important that IMA/EVM were separate from the rest of the LSMs,
       complete with their own hooks, infrastructure, etc. as it was the
       only way to enable IMA/EVM at the same time as a LSM.
    
       However, now that the bulk of the LSM infrastructure supports
       multiple simultaneous LSMs, we can simplify things greatly by
       bringing IMA/EVM into the LSM infrastructure as proper LSMs. This is
       something I've wanted to see happen for quite some time and Roberto
       was kind enough to put in the work to make it happen.
    
     - Use the LSM hook default values to simplify the call_int_hook() macro
    
       Previously the call_int_hook() macro required callers to supply a
       default return value, despite a default value being specified when
       the LSM hook was defined.
    
       This simplifies the macro by using the defined default return value
       which makes life easier for callers and should also reduce the number
       of return value bugs in the future (we've had a few pop up recently,
       hence this work).
    
     - Use the KMEM_CACHE() macro instead of kmem_cache_create()
    
       The guidance appears to be to use the KMEM_CACHE() macro when
       possible and there is no reason why we can't use the macro, so let's
       use it.
    
     - Fix a number of comment typos in the LSM hook comment blocks
    
       Not much to say here, we fixed some questionable grammar decisions in
       the LSM hook comment blocks.
    
    * tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (28 commits)
      cred: Use KMEM_CACHE() instead of kmem_cache_create()
      lsm: use default hook return value in call_int_hook()
      lsm: fix typos in security/security.c comment headers
      integrity: Remove LSM
      ima: Make it independent from 'integrity' LSM
      evm: Make it independent from 'integrity' LSM
      evm: Move to LSM infrastructure
      ima: Move IMA-Appraisal to LSM infrastructure
      ima: Move to LSM infrastructure
      integrity: Move integrity_kernel_module_request() to IMA
      security: Introduce key_post_create_or_update hook
      security: Introduce inode_post_remove_acl hook
      security: Introduce inode_post_set_acl hook
      security: Introduce inode_post_create_tmpfile hook
      security: Introduce path_post_mknod hook
      security: Introduce file_release hook
      security: Introduce file_post_open hook
      security: Introduce inode_post_removexattr hook
      security: Introduce inode_post_setattr hook
      security: Align inode_setattr hook definition with EVM
      ...
    cc4a875c
security.c 162 KB