Re: [PATCH v5 2/2] ima: Handle -ESTALE returned by ima_filter_rule_match()

From: Mimi Zohar <zohar@linux.ibm.com>
To: GUO Zihua <guozihua@huawei.com>,
	dmitry.kasatkin@gmail.com, paul@paul-moore.com,
	jmorris@namei.org, serge@hallyn.com
Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org
Subject: Re: [PATCH v5 2/2] ima: Handle -ESTALE returned by ima_filter_rule_match()
Date: Thu, 22 Sep 2022 07:09:57 -0400	[thread overview]
Message-ID: <ce948f9e5639345026679b31a818cc12a247ce60.camel@linux.ibm.com> (raw)
In-Reply-To: <20220921125804.59490-3-guozihua@huawei.com>

Hi Scott,

On Wed, 2022-09-21 at 20:58 +0800, GUO Zihua wrote:
>                 }
> -               if (!rc)
> -                       return false;
> +
> +               if (rc == -ESTALE && !rule_reinitialized) {

Ok, this limits allocating ima_lsm_copy_rule() to the first -ESTALE,

> +                       lsm_rule = ima_lsm_copy_rule(rule);
> +                       if (lsm_rule) {
> +                               rule_reinitialized = true;
> +                               goto retry;

but "retry" is also limited to the first -ESTALE.

> +                       }
> +               }
> +               if (!rc) {
> +                       result = false;
> +                       goto out;
> +               }
>         }
> -       return true;
> +       result = true;
> +
> +out:
> +       if (rule_reinitialized) {
> +               for (i = 0; i < MAX_LSM_RULES; i++)
> +                       ima_filter_rule_free(lsm_rule->lsm[i].rule);
> +               kfree(lsm_rule);
> +       }
> +       return result;
>  }

-- 

thanks,

Mimi