Merge tag 'ipe-pr-20261019' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe

Pull IPE updates from Fan Wu:

 - Fix an extra empty audit record on enforcement changes

   ipe_audit_enforce() started an audit buffer but logged the state
   change with audit_log(), which emits its own record. Ending the
   unused buffer produced an additional empty AUDIT_MAC_STATUS record
   every time the enforcement state was changed.

 - Keep the name and token tables in sync with their enums

   The audit name tables now use designated initializers, so each name
   stays bound to its enum value, and static assertions on the policy
   parser token tables break the build if an enum value is added without
   a matching token.

 - Constify token_default() and correct a comment about policy text
   ownership, with no functional changes

 - Fix an invalid sgid value in an audit event example in the docs

 - Point the docs to the new IPE website and test suite repository

* tag 'ipe-pr-20261019' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:
  ipe: update the project and test suite links
  ipe: fix enforcement audit
  ipe: correct policy text ownership comment
  ipe: check parser token table sizes
  ipe: use designated initializers for audit name tables
  ipe: constify token_default()
  ipe: fix invalid sgid value in audit event documentation

5 files changed, 36 insertions, 36 deletions

diff --git a/Documentation/admin-guide/LSM/ipe.rst b/Documentation/admin-guide/LSM/ipe.rst
index a756d8158531..9e82a2082b94 100644
--- a/Documentation/admin-guide/LSM/ipe.rst
+++ b/Documentation/admin-guide/LSM/ipe.rst
@@ -502,11 +502,11 @@ The following table lists the error codes that may appear in the errno field whi
 Event Examples::
 
    type=1404 audit(1653425689.008:55): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
-   type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=)
+   type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
    type=1327 audit(1653425689.008:55): proctitle="-bash"
 
    type=1404 audit(1653425689.008:55): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1
-   type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=)
+   type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
    type=1327 audit(1653425689.008:55): proctitle="-bash"
 
 This record will always be emitted in conjunction with a ``AUDITSYSCALL`` record for the ``write`` syscall.
@@ -791,7 +791,7 @@ Allow execution of a specific fs-verity file
 Additional Information
 ----------------------
 
-- `Github Repository <https://github.com/microsoft/ipe>`_
+- `IPE website <https://ipe-lsm.org/>`_
 - :doc:`Developer and design docs for IPE </security/ipe>`
 
 FAQ
diff --git a/Documentation/security/ipe.rst b/Documentation/security/ipe.rst
index 5eb3e6265fbd..4490aed5918a 100644
--- a/Documentation/security/ipe.rst
+++ b/Documentation/security/ipe.rst
@@ -442,5 +442,5 @@ IPE has KUnit Tests for the policy parser. Recommended kunitconfig::
   CONFIG_SECURITY_IPE_KUNIT_TEST=y
 
 In addition, IPE has a python based integration
-`test suite <https://github.com/microsoft/ipe/tree/test-suite>`_ that
+`test suite <https://github.com/Integrity-Policy-Enforcement/ci>`_ that
 can test both user interfaces and enforcement functionalities.
diff --git a/security/ipe/audit.c b/security/ipe/audit.c
index 93fb59fbddd6..b6f8fb54085a 100644
--- a/security/ipe/audit.c
+++ b/security/ipe/audit.c
@@ -34,34 +34,34 @@
 				    "new_policy_digest=" IPE_AUDIT_HASH_ALG ":"
 
 static const char *const audit_op_names[__IPE_OP_MAX + 1] = {
-	"EXECUTE",
-	"FIRMWARE",
-	"KMODULE",
-	"KEXEC_IMAGE",
-	"KEXEC_INITRAMFS",
-	"POLICY",
-	"X509_CERT",
-	"UNKNOWN",
+	[IPE_OP_EXEC]			= "EXECUTE",
+	[IPE_OP_FIRMWARE]		= "FIRMWARE",
+	[IPE_OP_KERNEL_MODULE]		= "KMODULE",
+	[IPE_OP_KEXEC_IMAGE]		= "KEXEC_IMAGE",
+	[IPE_OP_KEXEC_INITRAMFS]	= "KEXEC_INITRAMFS",
+	[IPE_OP_POLICY]			= "POLICY",
+	[IPE_OP_X509]			= "X509_CERT",
+	[IPE_OP_INVALID]		= "UNKNOWN",
 };
 
 static const char *const audit_hook_names[__IPE_HOOK_MAX] = {
-	"BPRM_CHECK",
-	"BPRM_CREDS_FOR_EXEC",
-	"MMAP",
-	"MPROTECT",
-	"KERNEL_READ",
-	"KERNEL_LOAD",
+	[IPE_HOOK_BPRM_CHECK]		= "BPRM_CHECK",
+	[IPE_HOOK_BPRM_CREDS_FOR_EXEC]	= "BPRM_CREDS_FOR_EXEC",
+	[IPE_HOOK_MMAP]			= "MMAP",
+	[IPE_HOOK_MPROTECT]		= "MPROTECT",
+	[IPE_HOOK_KERNEL_READ]		= "KERNEL_READ",
+	[IPE_HOOK_KERNEL_LOAD]		= "KERNEL_LOAD",
 };
 
 static const char *const audit_prop_names[__IPE_PROP_MAX] = {
-	"boot_verified=FALSE",
-	"boot_verified=TRUE",
-	"dmverity_roothash=",
-	"dmverity_signature=FALSE",
-	"dmverity_signature=TRUE",
-	"fsverity_digest=",
-	"fsverity_signature=FALSE",
-	"fsverity_signature=TRUE",
+	[IPE_PROP_BOOT_VERIFIED_FALSE]	= "boot_verified=FALSE",
+	[IPE_PROP_BOOT_VERIFIED_TRUE]	= "boot_verified=TRUE",
+	[IPE_PROP_DMV_ROOTHASH]		= "dmverity_roothash=",
+	[IPE_PROP_DMV_SIG_FALSE]	= "dmverity_signature=FALSE",
+	[IPE_PROP_DMV_SIG_TRUE]		= "dmverity_signature=TRUE",
+	[IPE_PROP_FSV_DIGEST]		= "fsverity_digest=",
+	[IPE_PROP_FSV_SIG_FALSE]	= "fsverity_signature=FALSE",
+	[IPE_PROP_FSV_SIG_TRUE]		= "fsverity_signature=TRUE",
 };
 
 /**
@@ -262,18 +262,10 @@ void ipe_audit_policy_load(const struct ipe_policy *const p)
  */
 void ipe_audit_enforce(bool new_enforce, bool old_enforce)
 {
-	struct audit_buffer *ab;
-
-	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS);
-	if (!ab)
-		return;
-
 	audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
 		  "enforcing=%d old_enforcing=%d auid=%u ses=%u"
 		  " enabled=1 old-enabled=1 lsm=ipe res=1",
 		  new_enforce, old_enforce,
 		  from_kuid(&init_user_ns, audit_get_loginuid(current)),
 		  audit_get_sessionid(current));
-
-	audit_log_end(ab);
 }
diff --git a/security/ipe/policy.c b/security/ipe/policy.c
index 827867be4fac..e542329726bc 100644
--- a/security/ipe/policy.c
+++ b/security/ipe/policy.c
@@ -52,7 +52,7 @@ void ipe_free_policy(struct ipe_policy *p)
 	ipe_del_policyfs_node(p);
 	ipe_free_parsed_policy(p->parsed);
 	/*
-	 * p->text is allocated only when p->pkcs7 is not NULL
+	 * p->text is allocated only when p->pkcs7 is NULL
 	 * otherwise it points to the plaintext data inside the pkcs7
 	 */
 	if (!p->pkcs7)
diff --git a/security/ipe/policy_parser.c b/security/ipe/policy_parser.c
index 6fa5bebf8471..309a61594e1d 100644
--- a/security/ipe/policy_parser.c
+++ b/security/ipe/policy_parser.c
@@ -128,6 +128,8 @@ static const match_table_t header_tokens = {
 	{__IPE_HEADER_MAX,		NULL}
 };
 
+static_assert(ARRAY_SIZE(header_tokens) == __IPE_HEADER_MAX + 1);
+
 /**
  * parse_header() - Parse policy header information.
  * @line: Supplies header line to be parsed.
@@ -201,7 +203,7 @@ out:
  * * %false	- The token is not "DEFAULT"
  * * %true	- The token is "DEFAULT"
  */
-static bool token_default(char *token)
+static bool token_default(const char *token)
 {
 	return !strcmp(token, "DEFAULT");
 }
@@ -240,6 +242,8 @@ static const match_table_t operation_tokens = {
 	{IPE_OP_INVALID,		NULL}
 };
 
+static_assert(ARRAY_SIZE(operation_tokens) == __IPE_OP_MAX + 1);
+
 /**
  * parse_operation() - Parse the operation type given a token string.
  * @t: Supplies the token string to be parsed.
@@ -259,6 +263,8 @@ static const match_table_t action_tokens = {
 	{IPE_ACTION_INVALID,	NULL}
 };
 
+static_assert(ARRAY_SIZE(action_tokens) == __IPE_ACTION_MAX + 1);
+
 /**
  * parse_action() - Parse the action type given a token string.
  * @t: Supplies the token string to be parsed.
@@ -284,6 +290,8 @@ static const match_table_t property_tokens = {
 	{IPE_PROP_INVALID,		NULL}
 };
 
+static_assert(ARRAY_SIZE(property_tokens) == __IPE_PROP_MAX + 1);
+
 /**
  * parse_property() - Parse a rule property given a token string.
  * @t: Supplies the token string to be parsed.