I've sent this patch series out a couple of times but at now 18 patches long and all having received acks I don't want to send the whole series again. I have a version based of off linus' tree including all of the ACKs I received on list and which has been run through the LTP test suite successfully. This series basically does two things. 1) removes all users of get_empty_filp() and init_file() 2) reworks the ima API to hide it under the LSM and remove its hooks into individual filesystems (shmem, pipes, hugetables, ecrypts, nfs, networking, ?afs?). This repo contains all of the patches including those which actually make init_file() static and remove init_file() from the headers. They remove the EXPORT_SYMBOL for those as well. If a deprecation is required for out of tree kernel code they can still be exported but that out of tree code will now certainly fail to work with IMA and will result in (harmless) printk spam. I'm not sure who the best person to pull this would be. VFS maintainer? Al? Should I just send straight to Linus? I'm not sure what the best path is. All of the individual fs changes have been acked by their respective maintainers and the IMA work has been acked by the IMA maintainer. The only patches without CLEAR acks and review are the two which remove the get_empty_filp() and init_file() calls. The following changes since commit 2b876f95d03e226394b5d360c86127cbefaf614b: Linus Torvalds (1): Merge branches 'timers-for-linus-ntp' and 'irq-core-for-linus' of git://git.kernel.org/.../tip/linux-2.6-tip are available in the git repository at: git://git.infradead.org/users/eparis/vfsima.git master Eric Paris (14): shmem: do not call fput_filp on an initialized filp shmem: use alloc_file instead of init_file pipes: use alloc-file instead of duplicating code inotify: use alloc_file instead of doing it internally networking: rework socket to fd mapping using alloc-file vfs: make init-file static fs: move get_empty_filp() deffinition to internal.h ima: valid return code from ima_inode_alloc ima: only insert at inode creation time ima: initialize ima before inodes can be allocated IMA: clean up the IMA counts updating code ima: call ima_inode_free ima_inode_free ima: move ima hooks to __dentry_open for easier ima API ima: rename ima_path_check to ima_file_check Mimi Zohar (4): ima: Fix refcnt bug in get_path_measurement security: move ima_file_check() to lsm hook ima: limit imbalance msg ima: rename PATH_CHECK to FILE_CHECK Documentation/ABI/testing/ima_policy | 12 +- fs/cachefiles/rdwr.c | 2 - fs/ecryptfs/main.c | 3 - fs/file_table.c | 81 +++++------ fs/hugetlbfs/inode.c | 2 - fs/internal.h | 1 + fs/namei.c | 35 +---- fs/nfsd/vfs.c | 14 -- fs/notify/inotify/inotify_user.c | 23 +- fs/open.c | 9 +- fs/pipe.c | 21 +-- include/asm-generic/fcntl.h | 8 + include/linux/file.h | 3 - include/linux/fs.h | 7 +- include/linux/ima.h | 16 +-- init/main.c | 2 +- ipc/mqueue.c | 2 - ipc/shm.c | 2 - mm/shmem.c | 25 ++-- net/socket.c | 123 ++++++---------- security/integrity/ima/ima.h | 6 +- security/integrity/ima/ima_api.c | 4 +- security/integrity/ima/ima_iint.c | 84 ++--------- security/integrity/ima/ima_main.c | 273 +++++++++++++++++----------------- security/integrity/ima/ima_policy.c | 19 ++- security/security.c | 8 +- 26 files changed, 324 insertions(+), 461 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html