Hi, I managed to hit a following BUG, looks like ima can call selinux_audit_rule_init that can sleep in rcu critical section in ima_match_policy(): __might_sleep kmem_cache_alloc_trace selinux_audit_rule_init <<< kzalloc (.. GFP_KERNEL) security_audit_rule_init ima_match_policy <<< list_for_each_entry_rcu ima_get_action process_measurement ima_file_check path_openat do_filp_open .. I guess this is the ima_match_rules() calling ima_lsm_update_rules() when it concludes that the selinux policy may have been reloaded. The easy way for me to fix my own butt in this regard is to change the selinux allocation not to wait, but Paul would you be OK with such change? The alternative looks like a pretty big change in the ima? -- Janne
