Hi Scott,
On Tue, 2022-08-30 at 20:29 +0800, GUO Zihua wrote:
> IMA relies on the blocking LSM policy notifier callback to update the
> LSM based IMA policy rules.
>
> When SELinux update its policies, IMA would be notified and starts
> updating all its lsm rules one-by-one. During this time, -ESTALE would
> be returned by ima_filter_rule_match() if it is called with a LSM rule
> that has not yet been updated. In ima_match_rules(), -ESTALE is not
> handled, and the LSM rule is considered a match, causing extra files
> to be measured by IMA.
>
> Fix it by actively updating current rule if -ESTALE is returned by
> ima_filter_rule_match().
>
> Fixes: b16942455193 ("ima: use the lsm policy update notifier")
> Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx>
> ---
>
> v3:
> Update current rule instead of just retrying, as suggested by Mimi
> v2:
> Fixes message errors pointed out by Mimi
>
> ---
> security/integrity/ima/ima_policy.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index a8802b8da946..62a5b6164923 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -616,6 +616,8 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
> else
> return false;
> }
> +
> +retry:
> switch (i) {
> case LSM_OBJ_USER:
> case LSM_OBJ_ROLE:
> @@ -635,6 +637,12 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
> default:
> break;
> }
> +
> + if (rc == -ESTALE) {
> + rc = ima_lsm_update_rule(rule);
This makes a copy of the rule, updates the LSM info, and then replaces
the original rule with the new rule. Is it really safe to update the
rule like this? The alternative would be to use a temporary rule with
the updated info.
Mimi
> + goto retry;
> + }
> if (!rc)
> return false;
> }
