Re: [RFC] IMA LSM based rule race condition issue on 4.19 LTS

["Guozihua (Scott)" <guozihua@huawei.com>]

On 2022/12/16 11:04, Paul Moore wrote:
> On Thu, Dec 15, 2022 at 9:36 PM Guozihua (Scott) <guozihua@huawei.com> wrote:
>> On 2022/12/16 5:04, Paul Moore wrote:
> 
> ...
> 
>>> How bad is the backport really?  Perhaps it is worth doing it to see
>>> what it looks like?
>>>
>> It might not be that bad, I'll try to post a version next Monday.
> 
> Thanks for giving it a shot.
> 
When I am trying a partial backport of b16942455193 ("ima: use the lsm
policy update notifier"), I took a closer look into it and if we rip off
the RCU and the notifier part, there would be a potential UAF issue when
multiple processes are calling ima_lsm_update_rule() and
ima_match_rules() at the same time. ima_lsm_update_rule() would free the
old rule if the new rule is successfully copied and initialized, leading
to ima_match_rules() accessing a freed rule.

To reserve the mainline solution, we would have to either introduce RCU
for rule access, which would work better with notifier mechanism or the
same rule would be updated multiple times, or we would have to introduce
a lock for LSM based rule update.

-- 
Best
GUO Zihua