[GIT PULL] integrity: subsystem updates for v6.19

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Linus,

There are two bug fixes: defer credentials checking from the bprm_check_security
hook to the bprm_creds_from_file security hook, properly ignore IMA policy rules
based on undefined SELinux labels.

And two IMA policy rule extensions: extend IMA to limit including file hashes in
the audit logs (dont_audit action), define a new filesystem subtype policy
option (fs_subtype).

And extend IMA to support commit b1ae6dc41eaa ("module: add in-kernel support
for decompressing") by deferring the IMA signature verification in
kernel_read_file() to after the kernel module is decompressed.

thanks,

Mimi

The following changes since commit 3a8660878839faadb4f1a6dd72c3179c1df56787:

  Linux 6.18-rc1 (2025-10-12 13:42:36 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/ tags/integrity-v6.19

for you to fetch changes up to 738c9738e690f5cea24a3ad6fd2d9a323cf614f6:

  ima: Handle error code returned by ima_filter_rule_match() (2025-11-21 07:24:01 -0500)

----------------------------------------------------------------
integrity-v6.19

----------------------------------------------------------------
Coiby Xu (1):
      ima: Access decompressed kernel module to verify appended signature

Jann Horn (2):
      ima: add dont_audit action to suppress audit actions
      ima: add fs_subtype condition for distinguishing FUSE instances

Roberto Sassu (1):
      ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook

Zhao Yipeng (1):
      ima: Handle error code returned by ima_filter_rule_match()

 Documentation/ABI/testing/ima_policy |  3 +-
 include/linux/kernel_read_file.h     |  1 +
 kernel/module/main.c                 | 17 ++++++++--
 security/integrity/ima/ima_main.c    | 62 +++++++++++++++++++++++++++---------
 security/integrity/ima/ima_policy.c  | 62 ++++++++++++++++++++++++++++++++----
 security/ipe/hooks.c                 |  1 +
 security/selinux/hooks.c             |  5 +--
 7 files changed, 123 insertions(+), 28 deletions(-)