Skip to content

Commit

Permalink
ima: Handle -ESTALE returned by ima_filter_rule_match()
Browse files Browse the repository at this point in the history
IMA relies on the blocking LSM policy notifier callback to update the
LSM based IMA policy rules.

When SELinux update its policies, IMA would be notified and starts
updating all its lsm rules one-by-one. During this time, -ESTALE would
be returned by ima_filter_rule_match() if it is called with a LSM rule
that has not yet been updated. In ima_match_rules(), -ESTALE is not
handled, and the LSM rule is considered a match, causing extra files
to be measured by IMA.

Fix it by re-initializing a temporary rule if -ESTALE is returned by
ima_filter_rule_match(). The origin rule in the rule list would be
updated by the LSM policy notifier callback.

Fixes: b169424 ("ima: use the lsm policy update notifier")
Signed-off-by: GUO Zihua <[email protected]>
Reviewed-by: Roberto Sassu <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>
  • Loading branch information
GUO Zihua authored and mimizohar committed Nov 2, 2022
1 parent d57378d commit c7423db
Showing 1 changed file with 32 additions and 9 deletions.
41 changes: 32 additions & 9 deletions security/integrity/ima/ima_policy.c
Original file line number Diff line number Diff line change
Expand Up @@ -545,6 +545,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
const char *func_data)
{
int i;
bool result = false;
struct ima_rule_entry *lsm_rule = rule;
bool rule_reinitialized = false;

if ((rule->flags & IMA_FUNC) &&
(rule->func != func && func != POST_SETATTR))
Expand Down Expand Up @@ -606,35 +609,55 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
int rc = 0;
u32 osid;

if (!rule->lsm[i].rule) {
if (!rule->lsm[i].args_p)
if (!lsm_rule->lsm[i].rule) {
if (!lsm_rule->lsm[i].args_p)
continue;
else
return false;
}

retry:
switch (i) {
case LSM_OBJ_USER:
case LSM_OBJ_ROLE:
case LSM_OBJ_TYPE:
security_inode_getsecid(inode, &osid);
rc = ima_filter_rule_match(osid, rule->lsm[i].type,
rc = ima_filter_rule_match(osid, lsm_rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rule);
lsm_rule->lsm[i].rule);
break;
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
rc = ima_filter_rule_match(secid, rule->lsm[i].type,
rc = ima_filter_rule_match(secid, lsm_rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rule);
lsm_rule->lsm[i].rule);
break;
default:
break;
}
if (!rc)
return false;

if (rc == -ESTALE && !rule_reinitialized) {
lsm_rule = ima_lsm_copy_rule(rule);
if (lsm_rule) {
rule_reinitialized = true;
goto retry;
}
}
if (!rc) {
result = false;
goto out;
}
}
return true;
result = true;

out:
if (rule_reinitialized) {
for (i = 0; i < MAX_LSM_RULES; i++)
ima_filter_rule_free(lsm_rule->lsm[i].rule);
kfree(lsm_rule);
}
return result;
}

/*
Expand Down

0 comments on commit c7423db

Please sign in to comment.