From patchwork Tue Aug 30 12:29:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Guozihua (Scott)" X-Patchwork-Id: 12959263 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DED9BECAAD4 for ; Tue, 30 Aug 2022 12:32:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229547AbiH3Mc3 (ORCPT ); Tue, 30 Aug 2022 08:32:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229451AbiH3Mc2 (ORCPT ); Tue, 30 Aug 2022 08:32:28 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74925AE22C for ; Tue, 30 Aug 2022 05:32:25 -0700 (PDT) Received: from dggpemm500024.china.huawei.com (unknown [172.30.72.55]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4MH68r5pXqzHnVZ; Tue, 30 Aug 2022 20:30:36 +0800 (CST) Received: from huawei.com (10.67.175.31) by dggpemm500024.china.huawei.com (7.185.36.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 30 Aug 2022 20:32:23 +0800 From: GUO Zihua To: , , , Subject: [PATCH v3] ima: Handle -ESTALE returned by ima_filter_rule_match() Date: Tue, 30 Aug 2022 20:29:06 +0800 Message-ID: <20220830122906.44496-1-guozihua@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.175.31] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpemm500024.china.huawei.com (7.185.36.203) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org IMA relies on the blocking LSM policy notifier callback to update the LSM based IMA policy rules. When SELinux update its policies, IMA would be notified and starts updating all its lsm rules one-by-one. During this time, -ESTALE would be returned by ima_filter_rule_match() if it is called with a LSM rule that has not yet been updated. In ima_match_rules(), -ESTALE is not handled, and the LSM rule is considered a match, causing extra files to be measured by IMA. Fix it by actively updating current rule if -ESTALE is returned by ima_filter_rule_match(). Fixes: b16942455193 ("ima: use the lsm policy update notifier") Signed-off-by: GUO Zihua --- v3: Update current rule instead of just retrying, as suggested by Mimi v2: Fixes message errors pointed out by Mimi --- security/integrity/ima/ima_policy.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index a8802b8da946..62a5b6164923 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -616,6 +616,8 @@ static bool ima_match_rules(struct ima_rule_entry *rule, else return false; } + +retry: switch (i) { case LSM_OBJ_USER: case LSM_OBJ_ROLE: @@ -635,6 +637,12 @@ static bool ima_match_rules(struct ima_rule_entry *rule, default: break; } + + if (rc == -ESTALE) { + rc = ima_lsm_update_rule(rule); + if (!rc) + goto retry; + } if (!rc) return false; }