v3
2026-11-11
引入内核保障平面KAP · v3
RFC提出Kernel Assurance Plane安全框架，定义KAP LSM ID与内部接口，用于持续验证内核完整性。
原始补丁链接
子 Patch（6）
1/6
docs: security: Describe the Kernel Assurance Plane design
Thank you for your contribution! Sashiko AI review found 1 potential issue to consider: - [Low] docs: security: kap: contradictory epoch semantics for bound tasks – commit 77da64268c0c9921ecf4f2c4
2/6
security: kap: add the LSM ID and internal headers
为 Kernel Assurance Plane 预留 LSM ID，并新增 include/linux/kap.h 与 security/kap/kap.h 声明内部共享结构；ID 暂取目标树下一个空闲值，待 LSM 维护者确认。
3/6
security: add the Kernel Assurance Plane LSM
Thank you for your contribution! Sashiko AI review found 22 potential issues to consider: - [Critical] security: kap: unpinned d_parent use-after-free in kap_path_link() - [High] security: kap: miss
4/6
security: kap: add the securityfs control plane
Thank you for your contribution! Sashiko AI review found 9 potential issues to consider: - [Medium] security: kap: dentry reference leak on child files in kapfs_mkdir() - [Medium] security: kap: una
5/6
kernel: add KAP checks for unshare and setns
Thank you for your contribution! Sashiko AI review found 1 potential issue to consider: - [High] security: kap: CLONE_NEWUSER skip in kap_check_namespace_flags() breaks user:unshare rules – commit
6/6
MAINTAINERS: add an entry for the Kernel Assurance Plane
在 MAINTAINERS 中新增 Kernel Assurance Plane 条目，列出 KAP 维护者及其负责的 security/kap 相关文件，便于后续补丁获得评审和归属。