Re: [PATCH v4 1/2] ima: measure loaded policy after write on securityfs policy file

[Mimi Zohar <zohar@linux.ibm.com>]

On Fri, 2026-06-26 at 09:32 +0000, Enrico  Bravi wrote:
> > 
> > > diff --git a/security/integrity/ima/ima_policy.c
> > > b/security/integrity/ima/ima_policy.c
> > > index f7f940a76922..0a70d10da70a 100644
> > > --- a/security/integrity/ima/ima_policy.c
> > > +++ b/security/integrity/ima/ima_policy.c
> > 
> > > @@ -2379,3 +2378,70 @@ bool ima_appraise_signature(enum kernel_read_file_id
> > > id)
> > >  	return found;
> > >  }
> > >  #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */
> > > +
> > > +/**
> > > +* ima_measure_loaded_policy - measure the active IMA policy ruleset
> > > +*
> > > +* Must be called with ima_write_mutex held, as it performs two
> > > +* separate RCU read passes over ima_rules and relies on the mutex
> > > +* to prevent concurrent policy updates between them.
> > > +*/
> > > +void ima_measure_loaded_policy(void)
> > > +{
> > > +	const char *event_name = "ima_policy_loaded";
> > > +	const char *op = "measure_loaded_ima_policy";
> > > +	struct ima_rule_entry *rule_entry;
> > > +	struct list_head *ima_rules_tmp;
> > > +	struct seq_file file;
> > > +	int result = -ENOMEM;
> > > +	size_t file_len = 0;
> > > +	char rule[512];
> > > +
> > > +	/* calculate IMA policy rules memory size */
> > > +	file.buf = rule;
> > > +	file.read_pos = 0;
> > > +	file.size = 512;
> > > +	file.count = 0;
> > > +
> > > +	lockdep_assert_held(&ima_write_mutex);
> > > +
> > > +	rcu_read_lock();
> > > +	ima_rules_tmp = rcu_dereference(ima_rules);
> > > +	list_for_each_entry_rcu(rule_entry, ima_rules_tmp, list) {
> > > +		ima_policy_show(&file, rule_entry);
> > > +		if (seq_has_overflowed(&file)) {
> > > +			result = -E2BIG;
> > > +			integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL,
> > > event_name,
> > > +					    op, "rule_length", result, 1);
> > > +			return;
> > 
> > On failure the new IMA policy will not be measured. Instead of hard coding the
> > buffer to 512, define a file static global variable to keep track of the
> > maximum
> > policy rule size.  ima_parse_add_rule() already returns the policy rule
> > length.
> > Before returning update the max policy rule size variable as necessary.
> > 
> > Here in ima_measure_loaded_policy() allocate/free the buffer.
> 
> Yes, this is much better. In this way the check on seq_has_overflowed() should
> not be necessary anymore.
> Thank you very much for your suggestions.

Right, it isn't necessary, but there's no harm in keeping it either.

> 
> > Missing rcu_read_unlock() before returning.
> > 

thanks,

Mimi