Re: [Patch V1] ima: avoid duplicate policy rules insertions

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2025-11-11 at 06:40 -0500, Mimi Zohar wrote:
> [Cc'ing Lennart Poettering]
> 
> On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote:
> > Prevent redundant IMA policy rules by checking for duplicates before insertion. This ensures that
> > rules are not re-added when userspace is restarted (using systemd-soft-reboot) without a full system
> > reboot. ima_rule_exists() detects duplicates in both temporary and active rule lists.
> > 
> > Signed-off-by: Tahera Fahimi <taherafahimi@linux.microsoft.com>
> 
> Sorry for the delay in responding ...
> 
> Before trying to fix the "problem", let's try to understand it first.  At least
> on my test system (-rc5), kexec is working as designed.  On boot, systemd
> replaces the existing builtin IMA policy with a custom IMA policy.  The arch
> specific policies are not affected, as they are persistent.  On a soft reboot
> (kexec), the IMA custom policy is re-loaded as expected.
> 
> To verify the above behavior, extend the IMA policy before the soft reboot. 
> Notice after the soft reboot that the original custom IMA policy is loaded and
> not the extended IMA policy.  Roberto, if there is a problem with this behavior,
> we'll discuss it independently of this proposed patch.
> 
> The question is why are you seeing duplicate IMA policy rules?  What is special
> about your environment?

I'm now able to reproduce what you're seeing by executing "systemctl soft-
reboot".  After each soft-reboot the custom IMA policy rules are re-loaded and
appended to the existing IMA policy.  As Roberto mentioned, there is no option
to replace the existing custom IMA policy rules with a new custom policy. We
might consider doing so in the future, but for now the onus for not re-loading
the custom IMA policy should not be on IMA, but on systemd.

Reading the same securityfs policy file used for loading the IMA policy will
return the current IMA policy. systemd could detect whether the existing IMA
policy contains the custom policy rules, before actually loading them.  There's
no reason for adding this functionality in the kernel.

-- 
thanks,

Mimi