On Sat, 2022-09-24 at 14:05 +0800, Guozihua (Scott) wrote: > I might have overlooked something, but if I understands the code > correctly, we would be copying the same rule over and over again till > the loop ends in that case. ima_lsm_update_rule() would replace the rule > node on the rule list without updating the rule in place. Although > synchronize_rcu() should prevent a UAF, the rule in ima_match_rules() > would not be updated. Meaning SELinux would always return -ESTALE before > we copy and retry as we keep passing in the outdated rule entry. After reviewing this patch set again, the code looks fine. The commit message is still a bit off, but I've pushed the patch set out to next- integrity-testing, waiting for some Reviewed-by/Tested-by tags. -- thanks, Mimi
