On Wed, 2022-09-28 at 10:11 -0400, Mimi Zohar wrote: > On Sat, 2022-09-24 at 14:05 +0800, Guozihua (Scott) wrote: > > > I might have overlooked something, but if I understands the code > > correctly, we would be copying the same rule over and over again > > till > > the loop ends in that case. ima_lsm_update_rule() would replace the > > rule > > node on the rule list without updating the rule in place. Although > > synchronize_rcu() should prevent a UAF, the rule in > > ima_match_rules() > > would not be updated. Meaning SELinux would always return -ESTALE > > before > > we copy and retry as we keep passing in the outdated rule entry. > > After reviewing this patch set again, the code looks fine. The > commit > message is still a bit off, but I've pushed the patch set out to > next- > integrity-testing, waiting for some Reviewed-by/Tested-by tags. The patches look ok for me. For both: Reviewed-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> Roberto
