Merge branch 'next-evm' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/ima-2.6 into next

Conflicts:
	fs/attr.c

Resolve conflict manually.

Signed-off-by: James Morris <jmorris@namei.org>

2 files changed, 29 insertions, 0 deletions

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
new file mode 100644
index 000000000000..8374d4557e5d
--- /dev/null
+++ b/Documentation/ABI/testing/evm
@@ -0,0 +1,23 @@
+What:           security/evm
+Date:           March 2011
+Contact:        Mimi Zohar <zohar@us.ibm.com>
+Description:
+                EVM protects a file's security extended attributes(xattrs)
+                against integrity attacks. The initial method maintains an
+                HMAC-sha1 value across the extended attributes, storing the
+                value as the extended attribute 'security.evm'.
+
+                EVM depends on the Kernel Key Retention System to provide it
+                with a trusted/encrypted key for the HMAC-sha1 operation.
+                The key is loaded onto the root's keyring using keyctl.  Until
+                EVM receives notification that the key has been successfully
+                loaded onto the keyring (echo 1 > <securityfs>/evm), EVM
+                can not create or validate the 'security.evm' xattr, but
+                returns INTEGRITY_UNKNOWN.  Loading the key and signaling EVM
+                should be done as early as possible.  Normally this is done
+                in the initramfs, which has already been measured as part
+                of the trusted boot.  For more information on creating and
+                loading existing trusted/encrypted keys, refer to:
+                Documentation/keys-trusted-encrypted.txt.  (A sample dracut
+                patch, which loads the trusted/encrypted key and enables
+                EVM, is available from http://linux-ima.sourceforge.net/#EVM.)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e279b7242912..cd7c86110147 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -48,6 +48,7 @@ parameter is applicable:
         EDD     BIOS Enhanced Disk Drive Services (EDD) is enabled
         EFI     EFI Partitioning (GPT) is enabled
         EIDE    EIDE/ATAPI support is enabled.
+        EVM     Extended Verification Module
         FB      The frame buffer device is enabled.
         GCOV    GCOV profiling is enabled.
         HW      Appropriate hardware is enabled.
@@ -758,6 +759,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         This option is obsoleted by the "netdev=" option, which
                         has equivalent usage. See its documentation for details.
 
+        evm=            [EVM]
+                        Format: { "fix" }
+                        Permit 'security.evm' to be updated regardless of
+                        current integrity status.
+
         failslab=
         fail_page_alloc=
         fail_make_request=[KNL]