Merge tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar...

Pull integrity updates from Mimi Zohar:
 "Four integrity changes: two IMA-overlay updates, an integrity Kconfig
  cleanup, and a secondary keyring update"

* tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: detect changes to the backing overlay file
  certs: Only allow certs signed by keys on the builtin keyring
  integrity: fix indentation of config attributes
  ima: annotate iint mutex to avoid lockdep false positive warnings

diff --combined fs/overlayfs/super.c
index 6cd949c59fed9f349484ff4b4de5712754ff4e22,c71d185980c08f1f36112be8c26c83b82b406d47..17864a8d2b85c4ff0b9339888daf9488f8998736
--- 1/fs/overlayfs/super.c
--- 2/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@@ -34,22 -34,14 +34,22 @@@ static struct dentry *ovl_d_real(struc
        struct dentry *real = NULL, *lower;
        int err;
  
 -      /* It's an overlay file */
 +      /*
 +       * vfs is only expected to call d_real() with NULL from d_real_inode()
 +       * and with overlay inode from file_dentry() on an overlay file.
 +       *
 +       * TODO: remove @inode argument from d_real() API, remove code in this
 +       * function that deals with non-NULL @inode and remove d_real() call
 +       * from file_dentry().
 +       */
        if (inode && d_inode(dentry) == inode)
                return dentry;
 +      else if (inode)
 +              goto bug;
  
        if (!d_is_reg(dentry)) {
 -              if (!inode || inode == d_inode(dentry))
 -                      return dentry;
 -              goto bug;
 +              /* d_real_inode() is only relevant for regular files */
 +              return dentry;
        }
  
        real = ovl_dentry_upper(dentry);
@@@ -495,13 -487,13 +495,13 @@@ static const struct xattr_handler ovl_o
        .set = ovl_other_xattr_set,
  };
  
 -static const struct xattr_handler *ovl_trusted_xattr_handlers[] = {
 +static const struct xattr_handler * const ovl_trusted_xattr_handlers[] = {
        &ovl_own_trusted_xattr_handler,
        &ovl_other_xattr_handler,
        NULL
  };
  
 -static const struct xattr_handler *ovl_user_xattr_handlers[] = {
 +static const struct xattr_handler * const ovl_user_xattr_handlers[] = {
        &ovl_own_user_xattr_handler,
        &ovl_other_xattr_handler,
        NULL
@@@ -1496,16 -1488,8 +1496,16 @@@ int ovl_fill_super(struct super_block *
        sb->s_xattr = ofs->config.userxattr ? ovl_user_xattr_handlers :
                ovl_trusted_xattr_handlers;
        sb->s_fs_info = ofs;
 +#ifdef CONFIG_FS_POSIX_ACL
        sb->s_flags |= SB_POSIXACL;
-       sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;
 +#endif
+       sb->s_iflags |= SB_I_SKIP_SYNC;
 +      /*
 +       * Ensure that umask handling is done by the filesystems used
 +       * for the the upper layer instead of overlayfs as that would
 +       * lead to unexpected results.
 +       */
 +      sb->s_iflags |= SB_I_NOUMASK;
  
        err = -ENOMEM;
        root_dentry = ovl_get_root(sb, ctx->upper.dentry, oe);

diff --combined security/integrity/Kconfig
index b6e074ac022730cf4a1f6331379db3827b40e424,1e151e6a5d3fad463f521c26f6db1f7c6599aec3..3c45f4f3455fb652f3847132d8c3d7290a57c3fa
--- 1/security/integrity/Kconfig
--- 2/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@@ -34,10 -34,10 +34,10 @@@ config INTEGRITY_ASYMMETRIC_KEY
        bool "Enable asymmetric keys support"
        depends on INTEGRITY_SIGNATURE
        default n
-         select ASYMMETRIC_KEY_TYPE
-         select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-         select CRYPTO_RSA
-         select X509_CERTIFICATE_PARSER
+       select ASYMMETRIC_KEY_TYPE
+       select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+       select CRYPTO_RSA
+       select X509_CERTIFICATE_PARSER
        help
          This option enables digital signature verification using
          asymmetric keys.
@@@ -53,14 -53,14 +53,14 @@@ config INTEGRITY_TRUSTED_KEYRIN
           keyring.
  
  config INTEGRITY_PLATFORM_KEYRING
-         bool "Provide keyring for platform/firmware trusted keys"
-         depends on INTEGRITY_ASYMMETRIC_KEYS
-         depends on SYSTEM_BLACKLIST_KEYRING
-         help
-          Provide a separate, distinct keyring for platform trusted keys, which
-          the kernel automatically populates during initialization from values
-          provided by the platform for verifying the kexec'ed kerned image
-          and, possibly, the initramfs signature.
+       bool "Provide keyring for platform/firmware trusted keys"
+       depends on INTEGRITY_ASYMMETRIC_KEYS
+       depends on SYSTEM_BLACKLIST_KEYRING
+       help
+         Provide a separate, distinct keyring for platform trusted keys, which
+         the kernel automatically populates during initialization from values
+         provided by the platform for verifying the kexec'ed kerned image
+         and, possibly, the initramfs signature.
  
  config INTEGRITY_MACHINE_KEYRING
        bool "Provide a keyring to which Machine Owner Keys may be added"
@@@ -68,11 -68,13 +68,11 @@@
        depends on INTEGRITY_ASYMMETRIC_KEYS
        depends on SYSTEM_BLACKLIST_KEYRING
        depends on LOAD_UEFI_KEYS || LOAD_PPC_KEYS
 -      select INTEGRITY_CA_MACHINE_KEYRING if LOAD_PPC_KEYS
 -      select INTEGRITY_CA_MACHINE_KEYRING_MAX if LOAD_PPC_KEYS
        help
-        If set, provide a keyring to which Machine Owner Keys (MOK) may
-        be added. This keyring shall contain just MOK keys.  Unlike keys
-        in the platform keyring, keys contained in the .machine keyring will
-        be trusted within the kernel.
+         If set, provide a keyring to which Machine Owner Keys (MOK) may
+         be added. This keyring shall contain just MOK keys.  Unlike keys
+         in the platform keyring, keys contained in the .machine keyring will
+         be trusted within the kernel.
  
  config INTEGRITY_CA_MACHINE_KEYRING
        bool "Enforce Machine Keyring CA Restrictions"
@@@ -97,14 -99,14 +97,14 @@@ config INTEGRITY_CA_MACHINE_KEYRING_MA
          .platform keyring.
  
  config LOAD_UEFI_KEYS
-        depends on INTEGRITY_PLATFORM_KEYRING
-        depends on EFI
-        def_bool y
+       depends on INTEGRITY_PLATFORM_KEYRING
+       depends on EFI
+       def_bool y
  
  config LOAD_IPL_KEYS
-        depends on INTEGRITY_PLATFORM_KEYRING
-        depends on S390
-        def_bool y
+       depends on INTEGRITY_PLATFORM_KEYRING
+       depends on S390
+       def_bool y
  
  config LOAD_PPC_KEYS
        bool "Enable loading of platform and blacklisted keys for POWER"