aboutsummaryrefslogtreecommitdiff
path: root/.mailmap
diff options
context:
space:
mode:
authorGUO Zihua2022-09-21 20:58:04 +0800
committerMimi Zohar2022-11-02 18:51:03 -0400
commitc7423dbdbc9ecef7fff5239d144cad4b9887f4de (patch)
treeeae883b16473d059dba6ac877af7c65b05d333d0 /.mailmap
parentd57378d3aa4d864d9e590482602068af1b20c0c5 (diff)
ima: Handle -ESTALE returned by ima_filter_rule_match()
IMA relies on the blocking LSM policy notifier callback to update the LSM based IMA policy rules. When SELinux update its policies, IMA would be notified and starts updating all its lsm rules one-by-one. During this time, -ESTALE would be returned by ima_filter_rule_match() if it is called with a LSM rule that has not yet been updated. In ima_match_rules(), -ESTALE is not handled, and the LSM rule is considered a match, causing extra files to be measured by IMA. Fix it by re-initializing a temporary rule if -ESTALE is returned by ima_filter_rule_match(). The origin rule in the rule list would be updated by the LSM policy notifier callback. Fixes: b16942455193 ("ima: use the lsm policy update notifier") Signed-off-by: GUO Zihua <guozihua@huawei.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to '.mailmap')
0 files changed, 0 insertions, 0 deletions