Hi Linus,
There are two main changes:
- TPM initialization is sometimes delayed until deferred_probe_initcall. Since
ordering is not guaranteed within the same initcall level, IMA may initialize
before the TPM and fall back to TPM-bypass mode. A new config option,
CONFIG_IMA_INIT_LATE_SYNC, allows those building the kernel to defer IMA
initialization to late_initcall_sync, accepting the integrity risk of missing
early measurements in exchange for avoiding TPM-bypass mode.
- The raw policy rules are now measured, as well as the complete policy, closing
a gap in integrity measurement coverage.
thanks,
Mimi
The following changes since commit b80bed5c871a80151351342c065579405ce77145:
ima: Instantiate file_truncate and path_truncate hooks (2026-08-04 12:35:02
-0400)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/
tags/integrity-v7.3
for you to fetch changes up to f1e10b10874051e4d99911dae0dd7b75a9f8ae66:
ima: measure userspace policy writes before parsing (2026-08-04 12:35:03
-0400)
----------------------------------------------------------------
integrity-v7.3
----------------------------------------------------------------
Enrico Bravi (2):
ima: add critical data measurement for loaded policy
ima: measure userspace policy writes before parsing
Jonathan McDowell (1):
security: ima: rename boot_aggregate when ima is initialised at late_sync
Yeoreum Yun (2):
security: lsm: allow LSMs to register for late_initcall_sync init
security: ima: introduce IMA_INIT_LATE_SYNC option
include/linux/lsm_hooks.h | 2 +
security/integrity/ima/Kconfig | 10 ++++
security/integrity/ima/ima.h | 5 ++
security/integrity/ima/ima_efi.c | 2 +
security/integrity/ima/ima_fs.c | 9 ++-
security/integrity/ima/ima_init.c | 15 +++--
security/integrity/ima/ima_main.c | 26 +++++++++
security/integrity/ima/ima_policy.c | 95 ++++++++++++++++++++++++++++++-
security/integrity/ima/ima_template_lib.c | 3 +-
security/lsm_init.c | 13 ++++-
10 files changed, 170 insertions(+), 10 deletions(-)
