• L
    Merge branch 'next-integrity' of... · f1f2f614
    Linus Torvalds 提交于
    Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
    
    Pull integrity updates from Mimi Zohar:
     "The major feature in this time is IMA support for measuring and
      appraising appended file signatures. In addition are a couple of bug
      fixes and code cleanup to use struct_size().
    
      In addition to the PE/COFF and IMA xattr signatures, the kexec kernel
      image may be signed with an appended signature, using the same
      scripts/sign-file tool that is used to sign kernel modules.
    
      Similarly, the initramfs may contain an appended signature.
    
      This contained a lot of refactoring of the existing appended signature
      verification code, so that IMA could retain the existing framework of
      calculating the file hash once, storing it in the IMA measurement list
      and extending the TPM, verifying the file's integrity based on a file
      hash or signature (eg. xattrs), and adding an audit record containing
      the file hash, all based on policy. (The IMA support for appended
      signatures patch set was posted and reviewed 11 times.)
    
      The support for appended signature paves the way for adding other
      signature verification methods, such as fs-verity, based on a single
      system-wide policy. The file hash used for verifying the signature and
      the signature, itself, can be included in the IMA measurement list"
    
    * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
      ima: ima_api: Use struct_size() in kzalloc()
      ima: use struct_size() in kzalloc()
      sefltest/ima: support appended signatures (modsig)
      ima: Fix use after free in ima_read_modsig()
      MODSIGN: make new include file self contained
      ima: fix freeing ongoing ahash_request
      ima: always return negative code for error
      ima: Store the measurement again when appraising a modsig
      ima: Define ima-modsig template
      ima: Collect modsig
      ima: Implement support for module-style appended signatures
      ima: Factor xattr_verify() out of ima_appraise_measurement()
      ima: Add modsig appraise_type option for module-style appended signatures
      integrity: Select CONFIG_KEYS instead of depending on it
      PKCS#7: Introduce pkcs7_get_digest()
      PKCS#7: Refactor verify_pkcs7_signature()
      MODSIGN: Export module signature definitions
      ima: initialize the "template" field with the default template
    f1f2f614
Makefile 1.4 KB
# SPDX-License-Identifier: GPL-2.0
###
# scripts contains sources for various helper programs used throughout
# the kernel for the build process.
# ---------------------------------------------------------------------------
# kallsyms:      Find all symbols in vmlinux
# pnmttologo:    Convert pnm files to logo files
# conmakehash:   Create chartable
# conmakehash:	 Create arrays for initializing the kernel console tables

HOST_EXTRACFLAGS += -I$(srctree)/tools/include

hostprogs-$(CONFIG_BUILD_BIN2C)  += bin2c
hostprogs-$(CONFIG_KALLSYMS)     += kallsyms
hostprogs-$(CONFIG_LOGO)         += pnmtologo
hostprogs-$(CONFIG_VT)           += conmakehash
hostprogs-$(BUILD_C_RECORDMCOUNT) += recordmcount
hostprogs-$(CONFIG_BUILDTIME_EXTABLE_SORT) += sortextable
hostprogs-$(CONFIG_ASN1)	 += asn1_compiler
hostprogs-$(CONFIG_MODULE_SIG_FORMAT) += sign-file
hostprogs-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += extract-cert
hostprogs-$(CONFIG_SYSTEM_EXTRA_CERTIFICATE) += insert-sys-cert

HOSTCFLAGS_sortextable.o = -I$(srctree)/tools/include
HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
HOSTLDLIBS_sign-file = -lcrypto
HOSTLDLIBS_extract-cert = -lcrypto

always		:= $(hostprogs-y) $(hostprogs-m)

# The following hostprogs-y programs are only build on demand
hostprogs-y += unifdef

subdir-$(CONFIG_GCC_PLUGINS) += gcc-plugins
subdir-$(CONFIG_MODVERSIONS) += genksyms
subdir-$(CONFIG_SECURITY_SELINUX) += selinux

# Let clean descend into subdirs
subdir-	+= basic dtc gdb kconfig mod
反馈
建议
客服 返回
顶部