lkml.org 
[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[GIT PULL] kernel hardening updates for v5.20-rc1
Hi Linus,

Please pull these kernel hardening updates for v5.20-rc1. Two
cross-maintainer notes: the dm-verity/loadpin changes are Acked by
Mike Snitzer but they have been carried in my treer; the LKDTM change
is duplicated in the drivers/misc tree (it was late in cycle when Greg
and I both picked it up).

Thanks!

-Kees

The following changes since commit a111daf0c53ae91e71fd2bfe7497862d14132e3e:

Linux 5.19-rc3 (2022-06-19 15:06:47 -0500)

are available in the Git repository at:

https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/hardening-v5.20-rc1

for you to fetch changes up to 27603a606fda0806d7c08914bc976931aa42020e:

dm: verity-loadpin: Drop use of dm_table_get_num_targets() (2022-07-28 21:48:12 -0700)

----------------------------------------------------------------
hardening updates for v5.20-rc1

- Fix Sparse warnings with randomizd kstack (GONG, Ruiqi)

- Replace uintptr_t with unsigned long in usercopy (Jason A. Donenfeld)

- Fix Clang -Wforward warning in LKDTM (Justin Stitt)

- Fix comment to correctly refer to STRICT_DEVMEM (Lukas Bulwahn)

- Introduce dm-verity binding logic to LoadPin LSM (Matthias Kaehlcke)

- Clean up warnings and overflow and KASAN tests (Kees Cook)

----------------------------------------------------------------
GONG, Ruiqi (1):
stack: Declare {randomize_,}kstack_offset to fix Sparse warnings

Jason A. Donenfeld (1):
usercopy: use unsigned long instead of uintptr_t

Justin Stitt (1):
drivers: lkdtm: fix clang -Wformat warning

Kees Cook (3):
MAINTAINERS: Add a general "kernel hardening" section
lib: overflow: Do not define 64-bit tests on 32-bit
kasan: test: Silence GCC 12 warnings

Lukas Bulwahn (1):
x86: mm: refer to the intended config STRICT_DEVMEM in a comment

Matthias Kaehlcke (4):
dm: Add verity helpers for LoadPin
LoadPin: Enable loading from trusted dm-verity devices
dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional compilation
dm: verity-loadpin: Drop use of dm_table_get_num_targets()

MAINTAINERS | 21 ++++-
arch/x86/mm/init.c | 2 +-
drivers/md/Makefile | 1 +
drivers/md/dm-verity-loadpin.c | 75 +++++++++++++++++
drivers/md/dm-verity-target.c | 33 +++++++-
drivers/md/dm-verity.h | 4 +
drivers/misc/lkdtm/bugs.c | 2 +-
include/linux/dm-verity-loadpin.h | 27 ++++++
include/uapi/linux/loadpin.h | 22 +++++
init/main.c | 1 +
lib/overflow_kunit.c | 6 ++
lib/test_kasan.c | 10 +++
mm/usercopy.c | 2 +-
security/loadpin/Kconfig | 16 ++++
security/loadpin/loadpin.c | 167 +++++++++++++++++++++++++++++++++++++-
15 files changed, 380 insertions(+), 9 deletions(-)
create mode 100644 drivers/md/dm-verity-loadpin.c
create mode 100644 include/linux/dm-verity-loadpin.h
create mode 100644 include/uapi/linux/loadpin.h

--
Kees Cook

\
 
 \ /
  Last update: 2022-08-01 19:54    [W:0.052 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site