Re: [PATCH] ima: Handle -ESTALE returned by ima_filter_rule_match()

["Guozihua (Scott)" <guozihua@huawei.com>]

On 2022/8/18 21:43, Mimi Zohar wrote:
> Hi Scott,
> 
> On Thu, 2022-08-18 at 10:05 +0800, GUO Zihua wrote:
>> IMA relies on lsm policy update notifier to be notified when it should
>> update it's lsm rules.
> 
> ^IMA relies on the blocking LSM policy notifier callback to update the
> LSM based IMA policy rules.

I'll fix this in the next version.
> 
>> When SELinux update it's policies, ima would be notified and starts
>> updating all its lsm rules one-by-one. During this time, -ESTALE would
>> be returned by ima_filter_rule_match() if it is called with a lsm rule
>> that has not yet been updated. In ima_match_rules(), -ESTALE is not
>> handled, and the lsm rule is considered a match, causing extra files
>> be measured by IMA.
>>
>> Fix it by retrying for at most three times if -ESTALE is returned by
>> ima_filter_rule_match().
> 
> With the lazy LSM policy update, retrying only once was needed.  With
> the blocking LSM notifier callback, why is three times needed?  Is this
> really a function of how long it takes IMA to walk and update ALL the
> LSM based IMA policy rules?  Would having SELinux wait for the -ESTALE
> to change do anything?

With lazy policy update, policy update is triggered and would be 
finished before retrying. However, with a notifier callback, the update 
runs in a different process which might introduce extra latency. 
Technically if one rule has been updated, any following rules would have 
been updated at the time they are read as well, thus the retry should 
happen on the first rule affected by SELinux policy update only. 
Retrying for three times here would leave some time for the notifier to 
finish it's job on updating the rules.
>>
>> Fixes: b16942455193 ("ima: use the lsm policy update notifier")
>> Signed-off-by: GUO Zihua <guozihua@huawei.com>
> 
> thanks,
> 
> Mimi
> 
> .


-- 
Best
GUO Zihua