Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar...

Pull integrity updates from Mimi Zohar:
 "Bug fixes, code clean up, and new features:

   - IMA policy rules can be defined in terms of LSM labels, making the
     IMA policy dependent on LSM policy label changes, in particular LSM
     label deletions. The new environment, in which IMA-appraisal is
     being used, frequently updates the LSM policy and permits LSM label
     deletions.

   - Prevent an mmap'ed shared file opened for write from also being
     mmap'ed execute. In the long term, making this and other similar
     changes at the VFS layer would be preferable.

   - The IMA per policy rule template format support is needed for a
     couple of new/proposed features (eg. kexec boot command line
     measurement, appended signatures, and VFS provided file hashes).

   - Other than the "boot-aggregate" record in the IMA measuremeent
     list, all other measurements are of file data. Measuring and
     storing the kexec boot command line in the IMA measurement list is
     the first buffer based measurement included in the measurement
     list"

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  integrity: Introduce struct evm_xattr
  ima: Update MAX_TEMPLATE_NAME_LEN to fit largest reasonable definition
  KEXEC: Call ima_kexec_cmdline to measure the boot command line args
  IMA: Define a new template field buf
  IMA: Define a new hook to measure the kexec boot command line arguments
  IMA: support for per policy rule template formats
  integrity: Fix __integrity_init_keyring() section mismatch
  ima: Use designated initializers for struct ima_event_data
  ima: use the lsm policy update notifier
  LSM: switch to blocking policy update notifiers
  x86/ima: fix the Kconfig dependency for IMA_ARCH_POLICY
  ima: Make arch_policy_entry static
  ima: prevent a file already mmap'ed write to be mmap'ed execute
  x86/ima: check EFI SetupMode too

diff --cc drivers/infiniband/core/device.c
Simple merge

diff --cc include/linux/ima.h
Simple merge

diff --cc kernel/kexec_file.c
Simple merge

diff --cc security/integrity/digsig.c
index ceb10553a6ba64a093a747bf1f5f1605ba9fecf6,37869214c2434054fdaf39e2bb9e1a3f8cfc0afc..f9f3c8ffe7864e1f9b6441f0e6c1aa3cabdfc322
--- 1/security/integrity/digsig.c
--- 2/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@@ -70,8 -73,9 +70,9 @@@ int integrity_digsig_verify(const unsig
        return -EOPNOTSUPP;
  }
  
- static int __integrity_init_keyring(const unsigned int id, struct key_acl *acl,
-                                   struct key_restriction *restriction)
+ static int __init __integrity_init_keyring(const unsigned int id,
 -                                         key_perm_t perm,
++                                         struct key_acl *acl,
+                                          struct key_restriction *restriction)
  {
        const struct cred *cred = current_cred();
        int err = 0;

diff --cc security/integrity/evm/evm_main.c
Simple merge

diff --cc security/integrity/ima/Kconfig
Simple merge

diff --cc security/integrity/ima/ima.h
Simple merge

diff --cc security/integrity/ima/ima_api.c
Simple merge

diff --cc security/integrity/ima/ima_appraise.c
Simple merge

diff --cc security/integrity/ima/ima_init.c
Simple merge

diff --cc security/integrity/ima/ima_main.c
Simple merge

diff --cc security/integrity/ima/ima_policy.c
Simple merge

diff --cc security/integrity/ima/ima_template.c
Simple merge

diff --cc security/integrity/ima/ima_template_lib.c
Simple merge

diff --cc security/integrity/ima/ima_template_lib.h
Simple merge

diff --cc security/integrity/integrity.h
Simple merge

diff --cc security/security.c
Simple merge

diff --cc security/selinux/hooks.c
Simple merge

diff --cc security/selinux/selinuxfs.c
Simple merge