From cf9610f9116d55c5a66ef9f1faecacabd93a9322 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Mon, 24 Aug 2026 08:46:03 -0700 Subject: Merge tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Use the non-blocking mux_state_try_select() in the generic MUX pin control back-end - Free pin maps on pinctrl_generic_to_map() failure in the core helpers New hardware pin control: - Qualcomm Maili TLMM SoC, PMG1110 PMIC, and Eliza LPASS LPI TLMM SoC (this is for the low power audio, LPASS = Low Power Audio SubSystem portions) - Upboard support on top of the Intel pin controller - Apple T6030 and T6031 support (just compatible strings) - Samsung Exynos 8855 SoC - Mediatek MT6858 SoC - Rockchip RK3308B and RV1106 SoCs - Airoha EN7523 and AN7563 SoCs Improvements: - Qualcomm TLMM GPIOs are unconditionally marked as wakeup capable - Qualcomm improvements on top of the Qualcomm PDC (power domain controller) irqchip improvements from tglx:s tree - Qualcomm IPQ806x and IPQ9650 non-urgent pin grop fixups - The NPCM8xx driver has been put into shape fixing many pin and group definitions - Some non-urgent Tegra 264 pin assignments are fixed up - Some non-urgent fixups to Airoha AN7581 and AN7583 registers and pin assignments, missing features etc" * tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (130 commits) dt-bindings: pinctrl: Convert TI DA850 pupd to DT schema pinctrl: meson: sync some modify from A4 pinctrl: meson: a4: Add input enable pin configuration pinctrl: realtek: rtd1625: remove unused group name spdif_sel pinctrl: realtek: rtd1625: fix base_bit for VE4 GPIO 13 dt-bindings: pinctrl: microchip,pic32mzda-pinctrl: Convert to DT schema Revert "Merge branch 'ib-rsk7204' into devel" pinctrl: rockchip: Add RV1106 pinctrl support dt-bindings: pinctrl: rockchip: Add RV1106 compatible pinctrl: rockchip: Decode drive strength in the get function pinctrl: fix PINCTRL_GENERIC_MUX not always being selectable pinctrl: airoha: add support of an7563 SoC dt-bindings: pinctrl: airoha: add support of an7563 pin controller pinctrl: airoha: try to find chip scu node by phandle first pinctrl: airoha: add support of en7523 SoC dt-bindings: pinctrl: airoha: add support of en7523 pin controller pinctrl: airoha: an7583: add support for olt pinmux pinctrl: airoha: an7583: add support for pon_alt pinmux pinctrl: airoha: an7583: add support for npu_uart pinmux dt-bindings: pinctrl: airoha: an7583: add missed features ... --- security/selinux/ima.c | 121 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) create mode 100644 security/selinux/ima.c (limited to 'security/selinux/ima.c') diff --git a/security/selinux/ima.c b/security/selinux/ima.c new file mode 100644 index 000000000..cda68122e --- /dev/null +++ b/security/selinux/ima.c @@ -0,0 +1,121 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2021 Microsoft Corporation + * + * Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com) + * + * Measure critical data structures maintained by SELinux + * using IMA subsystem. + */ +#include +#include +#include +#include "security.h" +#include "ima.h" + +static int selinux_ima_config_len __ro_after_init; + +/* + * selinux_ima_config_len_init - Compute the configuration settings string length + * + * The string is fixed text plus one digit per setting, so its length + * is known at boot. + */ +void __init selinux_ima_config_len_init(void) +{ + int buf_len, suffix_len, i; + + buf_len = strlen("initialized=0;enforcing=0;checkreqprot=0;") + 1; + suffix_len = strlen("=0;"); + + for (i = 0; i < __POLICYDB_CAP_MAX; i++) + buf_len += strlen(selinux_policycap_names[i]) + suffix_len; + + selinux_ima_config_len = buf_len; +} + +/* + * selinux_ima_collect_state - Read selinux configuration settings + * + * On success returns the configuration settings string. + * On error, returns NULL. + */ +static char *selinux_ima_collect_state(void) +{ + struct seq_buf s; + char *buf; + int i; + + buf = kzalloc(selinux_ima_config_len, GFP_KERNEL); + if (!buf) + return NULL; + + seq_buf_init(&s, buf, selinux_ima_config_len); + + seq_buf_printf(&s, "initialized=%d;enforcing=%d;checkreqprot=%d;", + selinux_initialized(), enforcing_enabled(), + checkreqprot_get()); + + for (i = 0; i < __POLICYDB_CAP_MAX; i++) + seq_buf_printf(&s, "%s=%d;", selinux_policycap_names[i], + selinux_state.policycap[i]); + + WARN_ON(seq_buf_has_overflowed(&s)); + + return buf; +} + +/* + * selinux_ima_measure_state_locked - Measure SELinux state and hash of policy + */ +void selinux_ima_measure_state_locked(void) +{ + char *state_str = NULL; + void *policy = NULL; + size_t policy_len; + int rc = 0; + + lockdep_assert_held(&selinux_state.policy_mutex); + + state_str = selinux_ima_collect_state(); + if (!state_str) { + pr_err("SELinux: %s: failed to read state.\n", __func__); + return; + } + + ima_measure_critical_data("selinux", "selinux-state", + state_str, strlen(state_str), false, + NULL, 0); + + kfree(state_str); + + /* + * Measure SELinux policy only after initialization is completed. + */ + if (!selinux_initialized()) + return; + + rc = security_read_state_kernel(&policy, &policy_len); + if (rc) { + pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc); + return; + } + + ima_measure_critical_data("selinux", "selinux-policy-hash", + policy, policy_len, true, + NULL, 0); + + vfree(policy); +} + +/* + * selinux_ima_measure_state - Measure SELinux state and hash of policy + */ +void selinux_ima_measure_state(void) +{ + lockdep_assert_not_held(&selinux_state.policy_mutex); + + mutex_lock(&selinux_state.policy_mutex); + selinux_ima_measure_state_locked(); + mutex_unlock(&selinux_state.policy_mutex); +} -- cgit v1.3.1