diff mbox series

[RFC,v3,02/10] ima: Nest iint mutex for DIGEST_LIST_CHECK hook

Message ID 20240905152512.3781098-3-roberto.sassu@huaweicloud.com (mailing list archive)
State New
Headers show
Series ima: Integrate with Integrity Digest Cache | expand

Commit Message

Roberto Sassu Sept. 5, 2024, 3:25 p.m. UTC 
From: Roberto Sassu <roberto.sassu@huawei.com>

Invoking digest_cache_get() inside the iint->mutex critical region can
cause deadlocks due to the fact that IMA can be recursively invoked for
reading the digest list. The deadlock would occur if the Integrity Digest
Cache attempts to read the same inode that is already locked by IMA.

However, since the Integrity Digest Cache makes sure that the above
situation never happens, as it checks the inodes, it is safe to call
digest_cache_get() inside the critical region and nest the iint->mutex
when the DIGEST_LIST_CHECK hook is executed.

Change the mutex_lock() call for the iint mutex into mutex_lock_nested(),
and add a subclass that is 0 if the IMA hook executed is not
DIGEST_LIST_CHECK, and 1 if it is.

Specifying the subclass does not interfere with the class annotation in
ima_iint_lockdep_annotate(), to make IMA work with overlayfs.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 security/integrity/ima/ima_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index cff8b5a12512..06ee99bd7886 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -266,7 +266,7 @@  static int process_measurement(struct file *file, const struct cred *cred,
 	if (!action)
 		goto out;
 
-	mutex_lock(&iint->mutex);
+	mutex_lock_nested(&iint->mutex, func == DIGEST_LIST_CHECK);
 
 	if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))
 		/* reset appraisal flags if ima_inode_post_setattr was called */