Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS

From: "Guozihua (Scott)" <guozihua@huawei.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Mimi Zohar <zohar@linux.ibm.com>, <dmitry.kasatkin@gmail.com>,
	Paul Moore <paul@paul-moore.com>, <sds@tycho.nsa.gov>,
	<eparis@parisplace.org>, <sashal@kernel.org>,
	<selinux@vger.kernel.org>,
	"linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>, <stable@vger.kernel.org>
Subject: Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS
Date: Fri, 9 Dec 2022 16:59:17 +0800	[thread overview]
Message-ID: <58219c48-840d-b4f3-b195-82b2a1465b37@huawei.com> (raw)
In-Reply-To: <Y5L10fjvxmU3klRu@kroah.com>

On 2022/12/9 16:46, Greg KH wrote:
> On Fri, Dec 09, 2022 at 03:53:25PM +0800, Guozihua (Scott) wrote:
>> On 2022/12/9 15:12, Greg KH wrote:
>>> On Fri, Dec 09, 2022 at 03:00:35PM +0800, Guozihua (Scott) wrote:
>>>> Hi community.
>>>>
>>>> Previously our team reported a race condition in IMA relates to LSM based
>>>> rules which would case IMA to match files that should be filtered out under
>>>> normal condition. The issue was originally analyzed and fixed on mainstream.
>>>> The patch and the discussion could be found here:
>>>> https://lore.kernel.org/all/20220921125804.59490-1-guozihua@huawei.com/
>>>>
>>>> After that, we did a regression test on 4.19 LTS and the same issue arises.
>>>> Further analysis reveled that the issue is from a completely different
>>>> cause.
>>>
>>> What commit in the tree fixed this in newer kernels?  Why can't we just
>>> backport that one to 4.19.y as well?
>>>
>>> thanks,
>>>
>>> greg k-h
>>
>> Hi Greg,
>>
>> The fix for mainline is now on linux-next, commit 	d57378d3aa4d ("ima:
>> Simplify ima_lsm_copy_rule") and 	c7423dbdbc9ece ("ima: Handle -ESTALE
>> returned by ima_filter_rule_match()"). However, these patches cannot be
>> picked directly into 4.19.y due to code difference.
> 
> Ok, so it's much more than just 4.19 that's an issue here.  And are
> those commits tagged for stable inclusion?

Not actually, not on the commit itself.
> 
>> The commit which introduced the issue on mainline was believed to be
>> b16942455193 ("ima: use the lsm policy update notifier"), which is not in
>> 4.19.y. And the mainline patch is designed to handle the situation when IMA
>> rules are accessed through RCU which has not been implemented on 4.19.y
>> either.
> 
> Ok, then provide a series of backports to 4.19 and we will be glad to
> review them.
If we are backporting these commits to 4.19 then maybe we would have to 
start with the commit that makes rule access in IMA RCU protected. I'll 
have a look into whether it's easy to do.
> 
> thanks,
> 
> greg k-h

-- 
Best
GUO Zihua