[GIT PULL] integrity: subsystem fixes for v7.3

[GIT PULL] integrity: subsystem fixes for v7.3

[Mimi Zohar]

Hi Linus,

There are two main changes:                                                     
                                                                                
- TPM initialization is sometimes delayed until deferred_probe_initcall. Since
ordering is not guaranteed within the same initcall level, IMA may initialize
before the TPM and fall back to TPM-bypass mode.  A new config option,
CONFIG_IMA_INIT_LATE_SYNC, allows those building the kernel to defer IMA
initialization to late_initcall_sync, accepting the integrity risk of missing
early measurements in exchange for avoiding TPM-bypass mode.
                                                                                
- The raw policy rules are now measured, as well as the complete policy, closing
a gap in integrity measurement coverage.

thanks,

Mimi

The following changes since commit b80bed5c871a80151351342c065579405ce77145:

  ima: Instantiate file_truncate and path_truncate hooks (2026-08-04 12:35:02 -0400)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/ tags/integrity-v7.3

for you to fetch changes up to f1e10b10874051e4d99911dae0dd7b75a9f8ae66:

  ima: measure userspace policy writes before parsing (2026-08-04 12:35:03 -0400)

----------------------------------------------------------------
integrity-v7.3

----------------------------------------------------------------
Enrico Bravi (2):
      ima: add critical data measurement for loaded policy
      ima: measure userspace policy writes before parsing

Jonathan McDowell (1):
      security: ima: rename boot_aggregate when ima is initialised at late_sync

Yeoreum Yun (2):
      security: lsm: allow LSMs to register for late_initcall_sync init
      security: ima: introduce IMA_INIT_LATE_SYNC option

 include/linux/lsm_hooks.h                 |  2 +
 security/integrity/ima/Kconfig            | 10 ++++
 security/integrity/ima/ima.h              |  5 ++
 security/integrity/ima/ima_efi.c          |  2 +
 security/integrity/ima/ima_fs.c           |  9 ++-
 security/integrity/ima/ima_init.c         | 15 +++--
 security/integrity/ima/ima_main.c         | 26 +++++++++
 security/integrity/ima/ima_policy.c       | 95 ++++++++++++++++++++++++++++++-
 security/integrity/ima/ima_template_lib.c |  3 +-
 security/lsm_init.c                       | 13 ++++-
 10 files changed, 170 insertions(+), 10 deletions(-)

Re: [GIT PULL] integrity: subsystem fixes for v7.3

[pr-tracker-bot]

The pull request you sent on Wed, 19 Aug 2026 20:10:38 -0400:

> https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/ tags/integrity-v7.3

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/a51ec5e8e5dae80824239f0344210060cb92a4b0

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html