Re: [PATCH 2/2] ima: Handle -ESTALE returned by ima_filter_rule_match()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Greg and Mimi.

Fall sick for a couple days.

On 2022/12/27 19:56, Mimi Zohar wrote:
> On Tue, 2022-12-27 at 08:37 +0100, Greg KH wrote:
>> On Tue, Dec 27, 2022 at 09:47:29AM +0800, GUO Zihua wrote:
>>> [ Upstream commit c7423dbdbc9ecef7fff5239d144cad4b9887f4de ]
>>
>> For obvious reasons we can not only take this patch (from 6.2-rc1) into
>> 4.19.y as that would cause people who upgrade from 4.19.y to a newer
>> stable kernel to have a regression.
>>
>> Please submit backports for all stable kernels if you wish to see this
>> in older ones to prevent problems like this from happening.
> 
> Sasha has already queued the original commit and the dependencies for
> the 6.1, 6.0, and 5.15 stable kernels.  Those kernels all had the
> call_lsm_notifier() to call_blocking_lsm_notifier() change.  Prior to
> 5.3, the change to the blocking notifier would need to be backported as
> well.  This version of the backport still needs to be reviewed.
Indeed the current solution needs further testing and review. One of the
concern raised by Huaxin is a possible UAF caused by the call to free
rule in update_rule. Will it be possible to backport also the change
which turn call_lsm_notifier() into call_blocking_lsm_notifier()?
> 
> thanks,
> 
> Mimi
> 
>>
>> But also, why are you still on 4.19.y?  What is wrong with 5.4.y at this
>> point in time?  If we dropped support for 4.19.y in January, what would
>> that cause to happen for your systems?
Well it's all about backward compatibility. We still got some products
using the 4.19.y LTS kernel and we would still needs to provide support
for this version of the kernel. If 4.19.y got EOL or EOS in January next
year, our company surely would develop corresponding plans to handle
that change.
>>
>> thanks,
>>
>> greg k-h
>>
> 

-- 
Best
GUO Zihua




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux