security subsystem · Supported

Maintainers

• M Paul Moore <paul@paul-moore.com>
• M James Morris <jmorris@namei.org>
• M "Serge E. Hallyn" <serge@hallyn.com>

Paths

• F include/linux/lsm/
• F include/linux/lsm_audit.h
• F include/linux/lsm_hook_defs.h
• F include/linux/lsm_hooks.h
• F include/linux/security.h
• F include/uapi/linux/lsm.h
• F security/
• F tools/testing/selftests/lsm/
• F rust/kernel/security.rs
• X security/selinux/

Last 30 days

Most active threads (last 7 days)

• HOTtoday [PATCH v3 00/20] Landlock tracepoints
  2026-07-22 17:12 · 13 replies in 7d · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH 0/6] landlock: Add POSIX message queue scoping
  2026-07-22 12:30 · 2 replies in 7d · Oxana Kharitonova <hidden>
• WARM1d [PATCH v2 0/3] Bring includes in linux/kmod.h up to date
  2026-07-21 13:12 · 1 reply in 7d · Petr Pavlu <petr.pavlu@suse.com>
• HOTtoday [PATCH] apparmor: update website link
  2026-07-21 11:28 · 0 replies in 7d · Baruch Siach <baruch@tkos.co.il>
• WARM1d [PATCH v3 0/2] Add Apple T2 NHI device links
  2026-07-21 06:34 · 1 reply in 7d · Atharva Tiwari <hidden>
• WARM1d [PATCH v2 0/2] Add Apple T2 NHI device links
  2026-07-21 05:45 · 1 reply in 7d · Atharva Tiwari <hidden>
• HOTtoday [PATCH v3 0/3] keys: fix keyring assoc-array out-of-bounds read and index inconsistency
  2026-07-19 16:15 · 2 replies in 7d · Michael Bommarito <hidden>
• WARM1d [PATCH v4] security: Expand task_setscheduler LSM hook
  2026-07-20 01:42 · 0 replies in 7d · Aaron Tomlin <atomlin@atomlin.com>
• WARM3d [PATCH 0/2] Add Apple T2 NHI device links
  2026-07-19 18:03 · 1 reply in 7d · Atharva Tiwari <hidden>
• COOLING5d [PATCH v2 0/3] Implement LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
  2026-07-17 22:03 · 1 reply in 7d · Justin Suess <hidden>

Active reviewers (last 30 days)

• Amir Goldstein <amir73il@gmail.com>
  6 attestations (6 Reviewed-by) · last on 2026-06-29
• Serge Hallyn <serge@hallyn.com>
  6 attestations (6 Reviewed-by) · last on 2026-06-29
• Christian Brauner <brauner@kernel.org>
  6 attestations (6 Reviewed-by) · last on 2026-06-29
• Stephen Smalley <stephen.smalley.work@gmail.com>
  2 attestations (2 Reviewed-by) · last on 2026-07-06
• Jarkko Sakkinen <jarkko@kernel.org>
  1 attestation (1 Reviewed-by) · last on 2026-07-19
• <hidden>
  1 attestation (1 Reported-by) · last on 2026-07-12
• Paul Moore <paul@paul-moore.com>
  1 attestation (1 Suggested-by) · last on 2026-07-08
• Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
  1 attestation (1 Acked-by) · last on 2026-07-06
• k2ci <hidden>
  1 attestation (1 Reported-by) · last on 2026-06-23

Recent patches

Most-recent 30 patches in this subsystem on linux-security-module (capped at 30), ordered by date desc.

• HOTtoday [PATCH v3 13/20] landlock: Add landlock_deny_access_fs and landlock_deny_access_net
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 14/20] landlock: Add tracepoints for ptrace and scope denials
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 12/20] landlock: Add tracepoints for rule checking
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 09/20] landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 11/20] landlock: Add landlock_enforce_domain tracepoint
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 10/20] landlock: Add create_domain and free_domain tracepoints
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 05/20] landlock: Decouple the per-denial logging decision from CONFIG_AUDIT
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 04/20] landlock: Split denial logging from audit into common framework
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 08/20] landlock: Add create_ruleset and free_ruleset tracepoints
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 06/20] landlock: Consolidate access-right and scope names in a shared header
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 02/20] landlock: Move domain query functions to domain.c
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 03/20] landlock: Split struct landlock_domain from struct landlock_ruleset
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH v3 01/20] landlock: Prepare ruleset and domain type split
  2026-07-22 · Mickaël Salaün <mic@digikod.net>
• HOTtoday [PATCH 3/6] landlock: Bump ABI for LANDLOCK_SCOPE_POSIX_MSG_QUEUE
  2026-07-22 · Oxana Kharitonova <hidden>
• HOTtoday [PATCH 2/6] landlock: Scope POSIX message queue opens
  2026-07-22 · Oxana Kharitonova <hidden>
• WARM1d [PATCH v2 1/3] umh, treewide: Explicitly include linux/umh.h where needed
  2026-07-21 · Petr Pavlu <petr.pavlu@suse.com>
• HOTtoday [PATCH] apparmor: update website link
  2026-07-21 · Baruch Siach <baruch@tkos.co.il>
• WARM1d [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip
  2026-07-21 · Atharva Tiwari <hidden>
• WARM1d [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
  2026-07-21 · Atharva Tiwari <hidden>
• WARM1d [PATCH v4] security: Expand task_setscheduler LSM hook
  2026-07-20 · Aaron Tomlin <atomlin@atomlin.com>
• WARM3d [PATCH 1/2] treewide: Add a flag to detect the Apple T2 chip
  2026-07-19 · Atharva Tiwari <hidden>
• HOTtoday REVIEWED: 5 (5M) [PATCH v3 2/3] keys: make keyring key-chunk byte order agree with keyring_diff_objects()
  2026-07-19 · Michael Bommarito <hidden>
• HOTtoday [PATCH v3 1/3] keys: fix out-of-bounds read in keyring_get_key_chunk()
  2026-07-19 · Michael Bommarito <hidden>
• COOLING5d [PATCH v2 1/3] landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
  2026-07-17 · Justin Suess <hidden>
• WARM1d [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
  2026-07-17 · Paul Moore <paul@paul-moore.com>
• DORMANTno replies [PATCH] ima: Report errno for failed hash collection to audit
  2026-07-16 · Frederick Lawler <hidden>
• COOLING8d [PATCH] apparmor: fix cred UAF caused by begin_current_label_crit_section()
  2026-07-14 · Jann Horn <jannh@google.com>
• COOLING4d [PATCH v2 2/3] keys: make keyring key-chunk byte order agree with keyring_diff_objects()
  2026-07-14 · Michael Bommarito <hidden>
• COOLING4d [PATCH v2 1/3] keys: fix out-of-bounds read in keyring_get_key_chunk()
  2026-07-14 · Michael Bommarito <hidden>
• COOLING6d [PATCH -next,v2] ima: add cond_resched() in ima_calc_file_hash_tfm loop
  2026-07-14 · Gaosheng Cui <hidden>

Needs attention (review trailers in, no pickup)

Patches with review trailers that haven't landed in mainline and haven't been Acked by a maintainer. Oldest first.

• STALE121d REVIEWED: 1 (1M) [PATCH v9 11/11] tpm-buf: Implement managed allocations
  2026-01-25 · Jarkko Sakkinen <jarkko@kernel.org> · 1 Reviewed-by
• STALE168d REVIEWED: 4 (4M) [PATCH v4] ima: Fallback to ctime check for FS without kstat.change_cookie
  2026-01-29 · Frederick Lawler <hidden> · 1 Reviewed-by
• STALE121d REVIEWED: 1 (1M) [PATCH v2 2/2] keys/trusted_keys: move TPM-specific fields into trusted_tpm_options
  2026-02-20 · Srish Srinivasan <ssrish@linux.ibm.com> · 1 Reviewed-by
• STALE145d REVIEWED: 8 (8M) [PATCH 1/2] ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG
  2026-02-26 · Thomas Weißschuh <linux@weissschuh.net> · 3 Reviewed-by
• DORMANTno replies REVIEWED: 5 (5M) FAILED: Patch "ima: verify the previous kernel's IMA buffer lies in addressable RAM" failed to apply to 6.12-stable tree
  2026-03-01 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 5 (5M) FAILED: Patch "ima: verify the previous kernel's IMA buffer lies in addressable RAM" failed to apply to 6.6-stable tree
  2026-03-01 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 5 (5M) FAILED: Patch "ima: verify the previous kernel's IMA buffer lies in addressable RAM" failed to apply to 6.1-stable tree
  2026-03-01 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 5 (5M) FAILED: Patch "ima: verify the previous kernel's IMA buffer lies in addressable RAM" failed to apply to 5.15-stable tree
  2026-03-01 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 5 (5M) FAILED: Patch "ima: verify the previous kernel's IMA buffer lies in addressable RAM" failed to apply to 5.10-stable tree
  2026-03-01 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• STALE139d REVIEWED: 1 (1M) [PATCH v2 4/8] module: Give MODULE_SIG_STRING a more descriptive name
  2026-03-05 · Thomas Weißschuh <hidden> · 1 Reviewed-by

Quiet for 30+ days

Patches with no review trailers and no replies. Either the author is heads-down elsewhere or these slipped through. Oldest first.

• STALE204d [PATCH 1/6] landlock: Add LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET scope bit to uAPI
  2025-12-28 · Tingmao Wang <hidden>
• STALE193d [PATCH v5] security: Add KUnit tests for kuid_root_in_ns and vfsuid_root_in_currentns
  2025-12-29 · Ryan Foster <hidden>
• STALE166d [PATCH v3 1/3] ima: make ima event log trimming configurable
  2026-01-06 · steven chen <hidden>
• STALE166d [PATCH v3 3/3] ima: add new critical data record to measure log trimming
  2026-01-06 · steven chen <hidden>
• DORMANTno replies [PATCH] landlock: Fix unsigned comparison in get_id_range()
  2026-01-13 · Samasth Norway Ananda <hidden>
• STALE184d [PATCH 07/12] mm: update shmem_[kernel]_file_*() functions to use vma_flags_t
  2026-01-19 · Lorenzo Stoakes <hidden>
• STALE181d [PATCH RESEND 07/12] mm: update shmem_[kernel]_file_*() functions to use vma_flags_t
  2026-01-19 · Lorenzo Stoakes <hidden>
• DORMANTno replies [PATCH] efi: Mark UEFI skip cert quirks list as __initconst
  2026-01-21 · Thomas Weißschuh <hidden>
• STALE121d [PATCH v9 07/11] KEYS: trusted: Re-orchestrate tpm2_read_public() calls
  2026-01-25 · Jarkko Sakkinen <jarkko@kernel.org>
• STALE166d [PATCH v5 1/3] ima: Unify vfs_getattr_nosec() stat comparisons under helper function
  2026-01-30 · Frederick Lawler <hidden>