Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS

From: "Guozihua (Scott)" <guozihua@huawei.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Mimi Zohar <zohar@linux.ibm.com>, <dmitry.kasatkin@gmail.com>,
	Paul Moore <paul@paul-moore.com>, <sds@tycho.nsa.gov>,
	<eparis@parisplace.org>, <sashal@kernel.org>,
	<selinux@vger.kernel.org>,
	"linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>, <stable@vger.kernel.org>
Subject: Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS
Date: Fri, 9 Dec 2022 17:11:40 +0800	[thread overview]
Message-ID: <d69f9bd3-de1f-aa32-7c6b-30d909f724d0@huawei.com> (raw)
In-Reply-To: <Y5L5RZlOOd9RMeWw@kroah.com>

On 2022/12/9 17:00, Greg KH wrote:
> On Fri, Dec 09, 2022 at 04:59:17PM +0800, Guozihua (Scott) wrote:
>> On 2022/12/9 16:46, Greg KH wrote:
>>> On Fri, Dec 09, 2022 at 03:53:25PM +0800, Guozihua (Scott) wrote:
>>>> On 2022/12/9 15:12, Greg KH wrote:
>>>>> On Fri, Dec 09, 2022 at 03:00:35PM +0800, Guozihua (Scott) wrote:
>>>>>> Hi community.
>>>>>>
>>>>>> Previously our team reported a race condition in IMA relates to LSM based
>>>>>> rules which would case IMA to match files that should be filtered out under
>>>>>> normal condition. The issue was originally analyzed and fixed on mainstream.
>>>>>> The patch and the discussion could be found here:
>>>>>> https://lore.kernel.org/all/20220921125804.59490-1-guozihua@huawei.com/
>>>>>>
>>>>>> After that, we did a regression test on 4.19 LTS and the same issue arises.
>>>>>> Further analysis reveled that the issue is from a completely different
>>>>>> cause.
>>>>>
>>>>> What commit in the tree fixed this in newer kernels?  Why can't we just
>>>>> backport that one to 4.19.y as well?
>>>>>
>>>>> thanks,
>>>>>
>>>>> greg k-h
>>>>
>>>> Hi Greg,
>>>>
>>>> The fix for mainline is now on linux-next, commit 	d57378d3aa4d ("ima:
>>>> Simplify ima_lsm_copy_rule") and 	c7423dbdbc9ece ("ima: Handle -ESTALE
>>>> returned by ima_filter_rule_match()"). However, these patches cannot be
>>>> picked directly into 4.19.y due to code difference.
>>>
>>> Ok, so it's much more than just 4.19 that's an issue here.  And are
>>> those commits tagged for stable inclusion?
>>
>> Not actually, not on the commit itself.
> 
> That's not good.  When they hit Linus's tree, please submit backports to
> the stable mailing list so that they can be picked up.
Thing is these commits cannot be simply backported to 4.19.y. Preceding
patches are missing. How do we do backporting in this situation? Do we
first backport the preceding patches? Or maybe we develop another
solution for 4.19.y?
> 
> thanks,
> 
> greg k-h

-- 
Best
GUO Zihua