Hi Linus,
There are 2 main changes, some code cleanup, and a couple of bug fixes.
Main changes:
- Introduce IMA and EVM post-quantum ML-DSA signature support
ML-DSA signature support for IMA and EVM is limited to sigv3 signatures, which
signs a hash of a compact structure containing the file data/metadata hash, hash
type, and hash algorithm. IMA and EVM still calculate the file data/metadata
hashes respectively.
- Introduce support for removing IMA measurement list records stored in kernel
memory
The IMA measurement list can grow large depending on policy, but removing
records breaks remote attestation, unless they are safely preserved and made
available for attestation requests. Until environments are prepared to preserve
the measurement records, a new CONFIG_IMA_STAGING Kconfig option is introduced
to guard against deletion.
Several approaches for removing measurement list records were evaluated but
rejected due to filesystem constraints, the introduction of a new critical data
record, and locking concerns. Two methods are being upstreamed: staged deletion
with confirmation, and staged deletion of N records without confirmation. Both
methods reduce the period during which new measurements are blocked from being
appended to the measurement list by staging the measurement list.` A comparison
of the two methods is included in the documentation.
Thanks,
Mimi
The following changes since commit 254f49634ee16a731174d2ae34bc50bd5f45e731:
Linux 7.1-rc1 (2026-04-26 14:19:00 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/
tags/integrity-v7.2
for you to fetch changes up to 35d6f5e788dae0dcc4c42d1280360f19aef9ab52:
doc: security: Add documentation of exporting and deleting IMA measurements
(2026-06-08 11:43:36 -0400)
----------------------------------------------------------------
integrity-v7.2
----------------------------------------------------------------
Goldwyn Rodrigues (1):
ima: return error early if file xattr cannot be changed
Kamlesh Kumar (1):
ima: Fix sigv3 signature handling for EVM_IMA_XATTR_DIGSIG
Pengpeng Hou (1):
evm: terminate and bound the evm_xattrs read buffer
Roberto Sassu (12):
ima: Remove ima_h_table structure
ima: Replace static htable queue with dynamically allocated array
ima: Introduce per binary measurements list type ima_num_records counter
ima: Introduce per binary measurements list type binary_runtime_size value
ima: Introduce _ima_measurements_start() and _ima_measurements_next()
ima: Mediate open/release method of the measurements list
ima: Use snprintf() in create_securityfs_measurement_lists
ima: Introduce ima_dump_measurement()
ima: Add support for staging measurements with prompt
ima: Add support for flushing the hash table when staging measurements
ima: Support staging and deleting N measurements records
doc: security: Add documentation of exporting and deleting IMA
measurements
Stefan Berger (4):
integrity: Check for NULL returned by asymmetric_key_public_key
integrity: Check that algo parameter is within valid range
integrity: Refactor asymmetric_verify for reusability
integrity: Add support for sigv3 verification using ML-DSA keys
Documentation/admin-guide/kernel-parameters.txt | 6 +
Documentation/security/IMA-export-delete.rst | 203 ++++++++++++++
Documentation/security/index.rst | 1 +
MAINTAINERS | 2 +
security/integrity/digsig_asymmetric.c | 152 +++++++++--
security/integrity/evm/evm_secfs.c | 16 +-
security/integrity/ima/Kconfig | 15 +
security/integrity/ima/ima.h | 28 +-
security/integrity/ima/ima_api.c | 2 +-
security/integrity/ima/ima_appraise.c | 10 +-
security/integrity/ima/ima_fs.c | 346 +++++++++++++++++++++---
security/integrity/ima/ima_init.c | 5 +
security/integrity/ima/ima_kexec.c | 42 ++-
security/integrity/ima/ima_policy.c | 3 +-
security/integrity/ima/ima_queue.c | 327 ++++++++++++++++++++--
15 files changed, 1057 insertions(+), 101 deletions(-)
create mode 100644 Documentation/security/IMA-export-delete.rst
