On 2022/8/22 22:41, Mimi Zohar wrote:
On Fri, 2022-08-19 at 09:50 +0800, Guozihua (Scott) wrote:
On 2022/8/18 21:43, Mimi Zohar wrote:
Hi Scott,
On Thu, 2022-08-18 at 10:05 +0800, GUO Zihua wrote:
IMA relies on lsm policy update notifier to be notified when it should
update it's lsm rules.
^IMA relies on the blocking LSM policy notifier callback to update the
LSM based IMA policy rules.
I'll fix this in the next version.
Thanks.
When SELinux update it's policies, ima would be notified and starts
updating all its lsm rules one-by-one. During this time, -ESTALE would
be returned by ima_filter_rule_match() if it is called with a lsm rule
that has not yet been updated. In ima_match_rules(), -ESTALE is not
handled, and the lsm rule is considered a match, causing extra files
be measured by IMA.
Fix it by retrying for at most three times if -ESTALE is returned by
ima_filter_rule_match().
With the lazy LSM policy update, retrying only once was needed. With
the blocking LSM notifier callback, why is three times needed? Is this
really a function of how long it takes IMA to walk and update ALL the
LSM based IMA policy rules? Would having SELinux wait for the -ESTALE
to change do anything?
With lazy policy update, policy update is triggered and would be
finished before retrying. However, with a notifier callback, the update
runs in a different process which might introduce extra latency.
Technically if one rule has been updated, any following rules would have
been updated at the time they are read as well, thus the retry should
happen on the first rule affected by SELinux policy update only.
Retrying for three times here would leave some time for the notifier to
finish it's job on updating the rules.
The question is whether we're waiting for the SELinux policy to change
from ESTALE or whether it is the number of SELinux based IMA policy
rules or some combination of the two. Retrying three times seems to be
random. If SELinux waited for ESTALE to change, then it would only be
dependent on the time it took to update the SELinux based IMA policy
rules.
We are waiting for ima_lsm_update_rules() to finish re-initializing all
the LSM based rules.
Once new policy takes effect in SELinux, the policy sequence number
would be incremented. During rule match, this sequence number is checked
and if mismatched, -ESTALE is returned and the rules should be
re-initialized. Normally during this time, ima_lsm_update_rules should
be running already, so we are going to wait for it to finish.
thanks,
Mimi
Fixes: b16942455193 ("ima: use the lsm policy update notifier")
Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx>
.
--
Best
GUO Zihua
