[v5,0/2] ima: Handle -ESTALE returned by ima_filter_rule_match()

Message

Guozihua (Scott) Sept. 21, 2022, 12:58 p.m. UTC

IMA happens to measure extra files if LSM based rules are specified and
the corresponding LSM is updating its policy.

The root cause is explained in the second patch.

GUO Zihua (2):
  ima: Simplify ima_lsm_copy_rule
  ima: Handle -ESTALE returned by ima_filter_rule_match()

 security/integrity/ima/ima_policy.c | 51 ++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 16 deletions(-)
---

v5:
  Updated code to avoid reusing rule. Fixed a potential mem leak caused
by race condition. Updated commit message for the first patch based on
Mimi's feedback.

v4:
  Use a tempory rule instead of updating the rule in place. To do that,
also update ima_lsm_copy_rule so we can make use of it.

v3:
  Update current rule instead of just retrying, as suggested by Mimi

v2:
  Fixes message errors pointed out by Mimi