Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <4fe1b4fbd47f9ee7ad92eaac7da1db642b126344.camel@linux.ibm.com>
Subject: Re: [PATCH v9 02/23] ima: Do not print policy rule with inactive
 LSM labels
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Christian Brauner <brauner@kernel.org>,
        Stefan Berger <stefanb@linux.vnet.ibm.com>
Cc:     linux-integrity@vger.kernel.org, serge@hallyn.com,
        christian.brauner@ubuntu.com, containers@lists.linux.dev,
        dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
        krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
        mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
        puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com,
        linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com,
        linux-security-module@vger.kernel.org, jmorris@namei.org,
        Stefan Berger <stefanb@linux.ibm.com>
Date:   Thu, 27 Jan 2022 09:12:49 -0500
In-Reply-To: <20220126083814.3ndwkhivir573aok@wittgenstein>
References: <20220125224645.79319-1-stefanb@linux.vnet.ibm.com>
         <20220125224645.79319-3-stefanb@linux.vnet.ibm.com>
         <20220126083814.3ndwkhivir573aok@wittgenstein>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi Christian,

On Wed, 2022-01-26 at 09:38 +0100, Christian Brauner wrote:
> On Tue, Jan 25, 2022 at 05:46:24PM -0500, Stefan Berger wrote:
> > From: Stefan Berger <stefanb@linux.ibm.com>
> > 
> > Before printing a policy rule scan for inactive LSM labels in the policy
> > rule. Inactive LSM labels are identified by args_p != NULL and
> > rule == NULL.
> > 
> > Fixes: b16942455193 ("ima: use the lsm policy update notifier")

Stefan, please refer to commit 483ec26eed42 ("ima: ima/lsm policy rule
loading logic bug fixes") instead.

> 
> That commit message of the referenced patch reads:
> 
> "Don't do lazy policy updates while running the rule matching, run the
> updates as they happen."
> 
> and given that we had a lengthy discussion how to update the rules I'd
> really would have liked an explanation why the update needs to run
> immediately. Not doing it lazily is the whole reason we have this
> notifier infra. Why can't this be done lazily?

The subject of the original thread leading up to registering a block
notifier is titled
"Subject: sleep in selinux_audit_rule_init".  The message id of the
original thread is 
CAHC9VhS=GsEVUmxtiV64o8G6i2nJpkzxzpyTADgN-vhV8pzZbg@mail.gmail.com.

This patch addresses a bug and could be upstreamed independently the
IMA namespacing patch set.  Should we defer including a summary from
the lazy update to block notifier discussion to "[PATCH v9 11/23] ima:
Move ima_lsm_policy_notifier into ima_namespace"?

thanks,

Mimi