From: "Guozihua (Scott)" <guozihua@huawei.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Mimi Zohar <zohar@linux.ibm.com>, <dmitry.kasatkin@gmail.com>,
Paul Moore <paul@paul-moore.com>, <sds@tycho.nsa.gov>,
<eparis@parisplace.org>, <sashal@kernel.org>,
<selinux@vger.kernel.org>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>, <stable@vger.kernel.org>
Subject: Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS
Date: Fri, 9 Dec 2022 15:53:25 +0800 [thread overview]
Message-ID: <93d137dc-e0d3-3741-7e01-dca1ba9c0903@huawei.com> (raw)
In-Reply-To: <Y5Lf8SRgyrqDJwiH@kroah.com>
On 2022/12/9 15:12, Greg KH wrote:
> On Fri, Dec 09, 2022 at 03:00:35PM +0800, Guozihua (Scott) wrote:
>> Hi community.
>>
>> Previously our team reported a race condition in IMA relates to LSM based
>> rules which would case IMA to match files that should be filtered out under
>> normal condition. The issue was originally analyzed and fixed on mainstream.
>> The patch and the discussion could be found here:
>> https://lore.kernel.org/all/20220921125804.59490-1-guozihua@huawei.com/
>>
>> After that, we did a regression test on 4.19 LTS and the same issue arises.
>> Further analysis reveled that the issue is from a completely different
>> cause.
>
> What commit in the tree fixed this in newer kernels? Why can't we just
> backport that one to 4.19.y as well?
>
> thanks,
>
> greg k-h
Hi Greg,
The fix for mainline is now on linux-next, commit d57378d3aa4d ("ima:
Simplify ima_lsm_copy_rule") and c7423dbdbc9ece ("ima: Handle -ESTALE
returned by ima_filter_rule_match()"). However, these patches cannot be
picked directly into 4.19.y due to code difference.
The commit which introduced the issue on mainline was believed to be
b16942455193 ("ima: use the lsm policy update notifier"), which is not
in 4.19.y. And the mainline patch is designed to handle the situation
when IMA rules are accessed through RCU which has not been implemented
on 4.19.y either.
--
Best
GUO Zihua
next prev parent reply other threads:[~2022-12-09 7:53 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-09 7:00 [RFC] IMA LSM based rule race condition issue on 4.19 LTS Guozihua (Scott)
2022-12-09 7:12 ` Greg KH
2022-12-09 7:53 ` Guozihua (Scott) [this message]
2022-12-09 8:46 ` Greg KH
2022-12-09 8:59 ` Guozihua (Scott)
2022-12-09 9:00 ` Greg KH
2022-12-09 9:11 ` Guozihua (Scott)
2022-12-09 9:22 ` Greg KH
2022-12-09 9:32 ` Guozihua (Scott)
2022-12-09 9:38 ` Guozihua (Scott)
2022-12-09 10:27 ` Greg KH
2022-12-12 2:39 ` Guozihua (Scott)
2022-12-13 15:30 ` Mimi Zohar
2022-12-14 1:33 ` Guozihua (Scott)
2022-12-14 12:19 ` Mimi Zohar
2022-12-15 8:51 ` Guozihua (Scott)
2022-12-15 10:49 ` Mimi Zohar
2022-12-15 13:15 ` Guozihua (Scott)
2022-12-15 14:30 ` Mimi Zohar
2022-12-15 21:04 ` Paul Moore
2022-12-16 2:36 ` Guozihua (Scott)
2022-12-16 3:04 ` Paul Moore
2022-12-19 7:10 ` Guozihua (Scott)
2022-12-19 13:11 ` Mimi Zohar
2022-12-20 1:11 ` Guozihua (Scott)
2022-12-21 10:51 ` Guozihua (Scott)
2022-12-23 8:04 ` Guozihua (Scott)
2022-12-24 3:41 ` Guozihua (Scott)
2022-12-24 7:47 ` Guozihua (Scott)
2023-01-06 1:05 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=93d137dc-e0d3-3741-7e01-dca1ba9c0903@huawei.com \
--to=guozihua@huawei.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=eparis@parisplace.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-integrity@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=sashal@kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.