Re: [Patch V1] ima: avoid duplicate policy rules insertions

[Mimi Zohar <zohar@linux.ibm.com>]

[Cc'ing Lennart Poettering]

On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote:
> Prevent redundant IMA policy rules by checking for duplicates before insertion. This ensures that
> rules are not re-added when userspace is restarted (using systemd-soft-reboot) without a full system
> reboot. ima_rule_exists() detects duplicates in both temporary and active rule lists.
> 
> Signed-off-by: Tahera Fahimi <taherafahimi@linux.microsoft.com>

Sorry for the delay in responding ...

Before trying to fix the "problem", let's try to understand it first.  At least
on my test system (-rc5), kexec is working as designed.  On boot, systemd
replaces the existing builtin IMA policy with a custom IMA policy.  The arch
specific policies are not affected, as they are persistent.  On a soft reboot
(kexec), the IMA custom policy is re-loaded as expected.

To verify the above behavior, extend the IMA policy before the soft reboot. 
Notice after the soft reboot that the original custom IMA policy is loaded and
not the extended IMA policy.  Roberto, if there is a problem with this behavior,
we'll discuss it independently of this proposed patch.

The question is why are you seeing duplicate IMA policy rules?  What is special
about your environment?

-- 
thanks,

Mimi