IMA relies on lsm policy update notifier to be notified when it should
update it's lsm rules.
When SELinux update it's policies, ima would be notified and starts
updating all its lsm rules one-by-one. During this time, -ESTALE would
be returned by ima_filter_rule_match() if it is called with a lsm rule
that has not yet been updated. In ima_match_rules(), -ESTALE is not
handled, and the lsm rule is considered a match, causing extra files
be measured by IMA.
Fix it by retrying for at most three times if -ESTALE is returned by
ima_filter_rule_match().
Fixes: b16942455193 ("ima: use the lsm policy update notifier")
Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx>
---
security/integrity/ima/ima_policy.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index a8802b8da946..6edc8cc48dec 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -609,6 +609,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
for (i = 0; i < MAX_LSM_RULES; i++) {
int rc = 0;
u32 osid;
+ int retried = 0;
if (!rule->lsm[i].rule) {
if (!rule->lsm[i].args_p)
@@ -616,6 +617,8 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
else
return false;
}
+
+retry:
switch (i) {
case LSM_OBJ_USER:
case LSM_OBJ_ROLE:
@@ -635,6 +638,11 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
default:
break;
}
+
+ if (rc == -ESTALE && retried < 3) {
+ retried++;
+ goto retry;
+ }
if (!rc)
return false;
}
--
2.17.1
