mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 06:44:00 -04:00
9cdca33667
Pull integrity updates from Mimi Zohar:
"There are two main changes, one feature removal, some code cleanup,
and a number of bug fixes.
Main changes:
- Detecting secure boot mode was limited to IMA. Make detecting
secure boot mode accessible to EVM and other LSMs
- IMA sigv3 support was limited to fsverity. Add IMA sigv3 support
for IMA regular file hashes and EVM portable signatures
Remove:
- Remove IMA support for asychronous hash calculation originally
added for hardware acceleration
Cleanup:
- Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG
tests
- Add descriptions of the IMA atomic flags
Bug fixes:
- Like IMA, properly limit EVM "fix" mode
- Define and call evm_fix_hmac() to update security.evm
- Fallback to using i_version to detect file change for filesystems
that do not support STATX_CHANGE_COOKIE
- Address missing kernel support for configured (new) TPM hash
algorithms
- Add missing crypto_shash_final() return value"
* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
evm: Enforce signatures version 3 with new EVM policy 'bit 3'
integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG
ima: add support to require IMA sigv3 signatures
ima: add regular file data hash signature version 3 support
ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures
ima: remove buggy support for asynchronous hashes
integrity: Eliminate weak definition of arch_get_secureboot()
ima: Add code comments to explain IMA iint cache atomic_flags
ima_fs: Correctly create securityfs files for unsupported hash algos
ima: check return value of crypto_shash_final() in boot aggregate
ima: Define and use a digest_size field in the ima_algo_desc structure
powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG
ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG
ima: fallback to using i_version to detect file change
evm: fix security.evm for a file with IMA signature
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
evm: Don't enable fix mode when secure boot is enabled
integrity: Make arch_ima_get_secureboot integrity-wide
86 lines
2.8 KiB
Makefile
86 lines
2.8 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the linux kernel.
|
|
#
|
|
|
|
ifdef CONFIG_FUNCTION_TRACER
|
|
|
|
# Do not trace tracer code
|
|
CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
|
|
|
|
# Do not trace early setup code
|
|
CFLAGS_REMOVE_early.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_rethook.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_stacktrace.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_unwind_bc.o = $(CC_FLAGS_FTRACE)
|
|
|
|
endif
|
|
|
|
GCOV_PROFILE_early.o := n
|
|
KCOV_INSTRUMENT_early.o := n
|
|
UBSAN_SANITIZE_early.o := n
|
|
KASAN_SANITIZE_ipl.o := n
|
|
KASAN_SANITIZE_machine_kexec.o := n
|
|
|
|
#
|
|
# Passing null pointers is ok for smp code, since we access the lowcore here.
|
|
#
|
|
CFLAGS_smp.o := -Wno-nonnull
|
|
|
|
#
|
|
# Disable tailcall optimizations for stack / callchain walking functions
|
|
# since this might generate broken code when accessing register 15 and
|
|
# passing its content to other functions.
|
|
#
|
|
CFLAGS_stacktrace.o += -fno-optimize-sibling-calls
|
|
CFLAGS_dumpstack.o += -fno-optimize-sibling-calls
|
|
CFLAGS_unwind_bc.o += -fno-optimize-sibling-calls
|
|
|
|
obj-y := head.o traps.o time.o process.o early.o setup.o idle.o vtime.o
|
|
obj-y += processor.o syscall.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o
|
|
obj-y += debug.o irq.o ipl.o dis.o vdso.o cpufeature.o
|
|
obj-y += sysinfo.o lgr.o os_info.o ctlreg.o
|
|
obj-y += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o sthyi.o
|
|
obj-y += entry.o reipl.o kdebugfs.o alternative.o skey.o
|
|
obj-y += nospec-branch.o ipl_vmparm.o machine_kexec_reloc.o unwind_bc.o
|
|
obj-y += smp.o text_amode31.o stacktrace.o abs_lowcore.o facility.o uv.o wti.o
|
|
obj-y += diag/
|
|
|
|
always-$(KBUILD_BUILTIN) += vmlinux.lds
|
|
|
|
obj-$(CONFIG_SYSFS) += nospec-sysfs.o
|
|
CFLAGS_REMOVE_nospec-branch.o += $(CC_FLAGS_EXPOLINE)
|
|
|
|
obj-$(CONFIG_SYSFS) += cpacf.o
|
|
obj-$(CONFIG_MODULES) += module.o
|
|
obj-$(CONFIG_SCHED_TOPOLOGY) += topology.o hiperdispatch.o
|
|
obj-$(CONFIG_NUMA) += numa.o
|
|
obj-$(CONFIG_AUDIT) += audit.o
|
|
obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
|
|
obj-$(CONFIG_KPROBES) += kprobes.o
|
|
obj-$(CONFIG_KPROBES) += mcount.o
|
|
obj-$(CONFIG_RETHOOK) += rethook.o
|
|
obj-$(CONFIG_FUNCTION_TRACER) += ftrace.o
|
|
obj-$(CONFIG_FUNCTION_TRACER) += mcount.o
|
|
obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
|
|
obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o
|
|
obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
|
|
obj-$(CONFIG_UPROBES) += uprobes.o
|
|
obj-$(CONFIG_JUMP_LABEL) += jump_label.o
|
|
obj-$(CONFIG_STACKPROTECTOR) += stackprotector.o
|
|
obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
|
|
obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o
|
|
obj-$(CONFIG_CERT_STORE) += cert_store.o
|
|
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_event.o
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf.o perf_cpum_sf.o
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf_events.o perf_regs.o
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_pai.o
|
|
|
|
obj-$(CONFIG_TRACEPOINTS) += trace.o
|
|
|
|
obj-$(CONFIG_BPF_SYSCALL) += bpf.o
|
|
|
|
# vdso
|
|
obj-y += vdso/
|