This is a note to let you know that I've just added the patch titled
ima: Handle -ESTALE returned by ima_filter_rule_match()
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ima-handle-estale-returned-by-ima_filter_rule_match.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c7423dbdbc9ecef7fff5239d144cad4b9887f4de Mon Sep 17 00:00:00 2001
From: GUO Zihua <guozihua@xxxxxxxxxx>
Date: Wed, 21 Sep 2022 20:58:04 +0800
Subject: ima: Handle -ESTALE returned by ima_filter_rule_match()
From: GUO Zihua <guozihua@xxxxxxxxxx>
commit c7423dbdbc9ecef7fff5239d144cad4b9887f4de upstream.
IMA relies on the blocking LSM policy notifier callback to update the
LSM based IMA policy rules.
When SELinux update its policies, IMA would be notified and starts
updating all its lsm rules one-by-one. During this time, -ESTALE would
be returned by ima_filter_rule_match() if it is called with a LSM rule
that has not yet been updated. In ima_match_rules(), -ESTALE is not
handled, and the LSM rule is considered a match, causing extra files
to be measured by IMA.
Fix it by re-initializing a temporary rule if -ESTALE is returned by
ima_filter_rule_match(). The origin rule in the rule list would be
updated by the LSM policy notifier callback.
Fixes: b16942455193 ("ima: use the lsm policy update notifier")
Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx>
Reviewed-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
security/integrity/ima/ima_policy.c | 37 ++++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -375,6 +375,9 @@ static bool ima_match_rules(struct ima_r
enum ima_hooks func, int mask)
{
int i;
+ bool result = false;
+ struct ima_rule_entry *lsm_rule = rule;
+ bool rule_reinitialized = false;
if ((rule->flags & IMA_FUNC) &&
(rule->func != func && func != POST_SETATTR))
@@ -413,35 +416,53 @@ static bool ima_match_rules(struct ima_r
int rc = 0;
u32 osid;
- if (!rule->lsm[i].rule)
+ if (!lsm_rule->lsm[i].rule)
continue;
+retry:
switch (i) {
case LSM_OBJ_USER:
case LSM_OBJ_ROLE:
case LSM_OBJ_TYPE:
security_inode_getsecid(inode, &osid);
rc = security_filter_rule_match(osid,
- rule->lsm[i].type,
+ lsm_rule->lsm[i].type,
Audit_equal,
- rule->lsm[i].rule,
+ lsm_rule->lsm[i].rule,
NULL);
break;
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
rc = security_filter_rule_match(secid,
- rule->lsm[i].type,
+ lsm_rule->lsm[i].type,
Audit_equal,
- rule->lsm[i].rule,
+ lsm_rule->lsm[i].rule,
NULL);
default:
break;
}
- if (!rc)
- return false;
+
+ if (rc == -ESTALE && !rule_reinitialized) {
+ lsm_rule = ima_lsm_copy_rule(rule);
+ if (lsm_rule) {
+ rule_reinitialized = true;
+ goto retry;
+ }
+ }
+ if (!rc) {
+ result = false;
+ goto out;
+ }
+ }
+ result = true;
+
+out:
+ if (rule_reinitialized) {
+ ima_lsm_free_rule(lsm_rule);
+ kfree(lsm_rule);
}
- return true;
+ return result;
}
/*
Patches currently in stable-queue which might be from guozihua@xxxxxxxxxx are
queue-4.19/lsm-switch-to-blocking-policy-update-notifiers.patch
queue-4.19/ima-use-the-lsm-policy-update-notifier.patch
queue-4.19/ima-handle-estale-returned-by-ima_filter_rule_match.patch
