Re: [PATCH] selinux: compute the IMA configuration settings string length once at boot

[Paul Moore <paul@paul-moore.com>]

On Jul 14, 2026 Ian Bridges <icb@fastmail.org> wrote:
> 
> selinux_ima_collect_state() builds a string of the current SELinux
> configuration settings. The string lists each setting as a name and
> one digit. The length of the string therefore never changes, but is
> still recomputed on every call.
> 
> Add selinux_ima_config_len_init() to compute the length once during
> selinux_init(). Update selinux_ima_collect_state() to use the stored
> length.
> 
> Suggested-by: Paul Moore <paul@paul-moore.com>
> Link: https://lore.kernel.org/r/df755e0282dab3b932d19aceab71b7d7@paul-moore.com
> Signed-off-by: Ian Bridges <icb@fastmail.org>
> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> The produced string is unchanged. selinux_ima_collect_state() now
> depends on selinux_ima_config_len_init() having run. The call sits in
> selinux_init(), as suggested in the review of the seq_buf conversion.
> 
> The length computation itself moves verbatim. The strlen() + 1 on
> the string literal could become sizeof(), which counts the
> terminator. That rewrite was left out so the moved block stays
> identical to the applied code.
> 
> The patch was tested as follows.
> 
> - W=1 build of security/selinux with CONFIG_IMA=y, zero warnings.
> - A userspace differential harness compiled the old and the new
>   functions side by side, covering every combination of the settings
>   and the policy capabilities. The outputs were byte identical. The
>   stored length was an exact fit for the produced string in every
>   case, with no overflow and no slack.
> 
>  security/selinux/hooks.c       |  3 +++
>  security/selinux/ima.c         | 33 ++++++++++++++++++++++++---------
>  security/selinux/include/ima.h |  4 ++++
>  3 files changed, 31 insertions(+), 9 deletions(-)

Merged into selinux/dev, thanks for doing this.

--
paul-moore.com