Re: [PATCH v5 1/4] ima: skip algorithm availability check until initramfs unpacking is finished

[sashiko-bot@kernel.org]

> With CONFIG_IMA_APPRAISE=y, restoring xattrs during initramfs unpacking
> can deadlock the kernel if the xattr being restored is signed with a hash
> that the kernel does not already have available. This occurs when the
> ima_inode_setxattr() hook calls crypto_has_alg(). crypto_has_alg() may
> synchronously request a module leading to a circular dependency where the
> userspace helper waits for initramfs unpacking to complete while initramfs
> unpacking waits for the userspace helper.
> 
> Guard this crypto availability check in validate_hash_algo() until
> initramfs unpacking is complete. This prevents the kernel from requesting
> a module during unpacking and allows security.ima xattrs to be restored
> even if the hash algorithm is unavailable in the running kernel.
> Essentially, this flag distinguishes restoration of existing metadata
> during initial population from setting/changing an xattr during runtime.
> 
> A benefit of this approach is that once unpacking is complete, all
> subsequent xattr updates go through the same codepath as before which
> preserves the existing behavior during normal userspace operation.
> 
> Signed-off-by: Danny Hu <dannyhu@arista.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261030210944.2143778-1-dannyhu@arista.com?part=1