Merge tag 'integrity-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar:

 - TPM initialization is sometimes delayed until deferred_probe_initcall

   Since ordering is not guaranteed within the same initcall level, IMA
   may initialize before the TPM and fall back to TPM-bypass mode. A new
   config option, CONFIG_IMA_INIT_LATE_SYNC, allows those building the
   kernel to defer IMA initialization to late_initcall_sync, accepting
   the integrity risk of missing early measurements in exchange for
   avoiding TPM-bypass mode.

 - The raw policy rules are now measured, as well as the complete
   policy, closing a gap in integrity measurement coverage

* tag 'integrity-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: measure userspace policy writes before parsing
  ima: add critical data measurement for loaded policy
  security: ima: rename boot_aggregate when ima is initialised at late_sync
  security: ima: introduce IMA_INIT_LATE_SYNC option
  security: lsm: allow LSMs to register for late_initcall_sync init

1 files changed, 2 insertions, 0 deletions

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index b4f8cad53ddb..c4488c4a6d8a 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -167,6 +167,7 @@ enum lsm_order {
  * @initcall_fs: LSM callback for fs_initcall setup, optional
  * @initcall_device: LSM callback for device_initcall() setup, optional
  * @initcall_late: LSM callback for late_initcall() setup, optional
+ * @initcall_late_sync: LSM callback for late_initcall_sync() setup, optional
  */
 struct lsm_info {
 	const struct lsm_id *id;
@@ -182,6 +183,7 @@ struct lsm_info {
 	int (*initcall_fs)(void);
 	int (*initcall_device)(void);
 	int (*initcall_late)(void);
+	int (*initcall_late_sync)(void);
 };
 
 #define DEFINE_LSM(lsm)							\