Re: [PATCH] ima: reject duplicate fsname= in a policy rule

[sashiko-bot@kernel.org]

> From: Weidong Wang <weidongw@illinois.edu>
> 
> ima_parse_rule() stores the fsname= value with kstrdup() but, unlike
> fsmagic=, fs_subtype= and the other options, does not check whether the
> rule already has one. A rule that names fsname= twice overwrites
> entry->fsname and leaks the first string.
> 
> Reject the duplicate with -EINVAL, as fs_subtype= does. Such a rule used
> to be accepted with the last fsname= taking effect; giving the option
> twice was never meaningful, and the other options already reject it.
> 
> Writing the policy requires CAP_SYS_ADMIN, so the leak is limited to a
> few bytes per malformed rule loaded by a privileged user.
> 
> The leak was found by an AI code review agent (an LLM-based bug-finding
> tool developed by Zijie Zhao and the submitter) and confirmed on an
> unmodified kernel, without error injection, on x86_64 under QEMU with
> kmemleak: loading 64 rules with a duplicated fsname= left 64
> unreferenced objects allocated by kstrdup() in ima_parse_rule() (inlined
> into ima_parse_add_rule()); the same rules with a single fsname= left
> none. With this patch the duplicate rules are rejected and kmemleak
> reports nothing; rules with a single fsname= are still accepted.
> 
> The reproducer, fix and changelog were drafted with AI assistance
> (Claude), then reviewed and tested by the submitter.
> 
> Fixes: f1b08bbcbdaf ("ima: define a new policy condition based on the filesystem name")
> Cc: Zijie Zhao <zijie4@illinois.edu>
> Signed-off-by: Weidong Wang <weidongw@illinois.edu>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-c3-n204-v1-1-dd9400b9ece8@illinois.edu?part=1