linux/security/integrity, branch v3.6

ima: audit is compiled only when enabled

2012-07-05T20:43:59Z

IMA auditing code was compiled even when CONFIG_AUDIT was not enabled. This patch compiles auditing code only when possible and enabled. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

ima: ima_initialized is set only if successful

2012-07-05T20:43:57Z

Set ima_initialized only if initialization was successful. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

ima: add policy for pseudo fs

2012-07-05T20:42:33Z

Exclude DEVPTS and BINFMT filesystems from the measurement policy. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

ima: remove unused cleanup functions

2012-07-02T20:43:30Z

IMA cannot be used as module and does not need __exit functions. Removed them. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

ima: free securityfs violations file

2012-07-02T20:43:30Z

On ima_fs_init() error, free securityfs violations file. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

ima: use full pathnames in measurement list

2012-07-02T20:43:29Z

The IMA measurement list contains filename hints, which can be ambigious without the full pathname. This patch replaces the filename hint with the full pathname, simplifying for userspace the correlating of file hash measurements with files. Change log v1: - Revert to short filenames, when full pathname is longer than IMA measurement buffer size. (Based on Dmitry's review) Signed-off-by: Mimi Zohar

ima: fix filename hint to reflect script interpreter name

2012-05-16T00:36:41Z

When IMA was first upstreamed, the bprm filename and interp were always the same. Currently, the bprm->filename and bprm->interp are the same, except for when only bprm->interp contains the interpreter name. So instead of using the bprm->filename as the IMA filename hint in the measurement list, we could replace it with bprm->interp, but this feels too fragil. The following patch is not much better, but at least there is some indication that sometimes we're passing the filename and other times the interpreter name. Reported-by: Andrew Lunn Signed-off-by: Mimi Zohar Signed-off-by: James Morris

security: fix ima kconfig warning

2012-02-28T00:01:15Z

Fix IMA kconfig warning on non-X86 architectures: warning: (IMA) selects TCG_TIS which has unmet direct dependencies (TCG_TPM && X86) Signed-off-by: Randy Dunlap Reported-by: Geert Uytterhoeven Acked-by: Rajiv Andrade Signed-off-by: James Morris

IMA: fix audit res field to indicate 1 for success and 0 for failure

2012-02-16T01:01:42Z

The audit res field ususally indicates success with a 1 and 0 for a failure. So make IMA do it the same way. Signed-off-by: Eric Paris Signed-off-by: Mimi Zohar Signed-off-by: James Morris

Merge branch 'next-queue' into next

2012-02-09T06:02:34Z