Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security

* 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
  TOMOYO: Fix incomplete read after seek.
  Smack: allow to access /smack/access as normal user
  TOMOYO: Fix unused kernel config option.
  Smack: fix: invalid length set for the result of /smack/access
  Smack: compilation fix
  Smack: fix for /smack/access output, use string instead of byte
  Smack: domain transition protections (v3)
  Smack: Provide information for UDS getsockopt(SO_PEERCRED)
  Smack: Clean up comments
  Smack: Repair processing of fcntl
  Smack: Rule list lookup performance
  Smack: check permissions from user space (v2)
  TOMOYO: Fix quota and garbage collector.
  TOMOYO: Remove redundant tasklist_lock.
  TOMOYO: Fix domain transition failure warning.
  TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
  TOMOYO: Simplify garbage collector.
  TOMOYO: Fix make namespacecheck warnings.
  target: check hex2bin result
  encrypted-keys: check hex2bin result
  ...

1 files changed, 23 insertions, 0 deletions

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
new file mode 100644
index 000000000000..8374d4557e5d
--- /dev/null
+++ b/Documentation/ABI/testing/evm
@@ -0,0 +1,23 @@
+What:           security/evm
+Date:           March 2011
+Contact:        Mimi Zohar <zohar@us.ibm.com>
+Description:
+                EVM protects a file's security extended attributes(xattrs)
+                against integrity attacks. The initial method maintains an
+                HMAC-sha1 value across the extended attributes, storing the
+                value as the extended attribute 'security.evm'.
+
+                EVM depends on the Kernel Key Retention System to provide it
+                with a trusted/encrypted key for the HMAC-sha1 operation.
+                The key is loaded onto the root's keyring using keyctl.  Until
+                EVM receives notification that the key has been successfully
+                loaded onto the keyring (echo 1 > <securityfs>/evm), EVM
+                can not create or validate the 'security.evm' xattr, but
+                returns INTEGRITY_UNKNOWN.  Loading the key and signaling EVM
+                should be done as early as possible.  Normally this is done
+                in the initramfs, which has already been measured as part
+                of the trusted boot.  For more information on creating and
+                loading existing trusted/encrypted keys, refer to:
+                Documentation/keys-trusted-encrypted.txt.  (A sample dracut
+                patch, which loads the trusted/encrypted key and enables
+                EVM, is available from http://linux-ima.sourceforge.net/#EVM.)