lkml.org 
[lkml]   [2022]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v9 02/23] ima: Do not print policy rule with inactive LSM labels
From
Date
Hi Christian,

On Wed, 2022-01-26 at 09:38 +0100, Christian Brauner wrote:
> On Tue, Jan 25, 2022 at 05:46:24PM -0500, Stefan Berger wrote:
> > From: Stefan Berger <stefanb@linux.ibm.com>
> >
> > Before printing a policy rule scan for inactive LSM labels in the policy
> > rule. Inactive LSM labels are identified by args_p != NULL and
> > rule == NULL.
> >
> > Fixes: b16942455193 ("ima: use the lsm policy update notifier")

Stefan, please refer to commit 483ec26eed42 ("ima: ima/lsm policy rule
loading logic bug fixes") instead.

>
> That commit message of the referenced patch reads:
>
> "Don't do lazy policy updates while running the rule matching, run the
> updates as they happen."
>
> and given that we had a lengthy discussion how to update the rules I'd
> really would have liked an explanation why the update needs to run
> immediately. Not doing it lazily is the whole reason we have this
> notifier infra. Why can't this be done lazily?

The subject of the original thread leading up to registering a block
notifier is titled
"Subject: sleep in selinux_audit_rule_init". The message id of the
original thread is
CAHC9VhS=GsEVUmxtiV64o8G6i2nJpkzxzpyTADgN-vhV8pzZbg@mail.gmail.com.

This patch addresses a bug and could be upstreamed independently the
IMA namespacing patch set. Should we defer including a summary from
the lazy update to block notifier discussion to "[PATCH v9 11/23] ima:
Move ima_lsm_policy_notifier into ima_namespace"?

thanks,

Mimi

\
 
 \ /
  Last update: 2022-01-27 15:14    [W:0.156 / U:0.324 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site