Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ba9a7f72-3a68-d3fe-a55d-ff1e4ac41e6e@linux.ibm.com>
Date:   Thu, 7 Jul 2022 10:12:09 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.0
Subject: Re: [PATCH v12 04/26] ima: Move arch_policy_entry into ima_namespace
Content-Language: en-US
To:     "Serge E. Hallyn" <serge@hallyn.com>
Cc:     linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        christian.brauner@ubuntu.com, containers@lists.linux.dev,
        dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
        krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
        mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
        puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com,
        linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com,
        linux-security-module@vger.kernel.org, jmorris@namei.org,
        jpenumak@redhat.com, Christian Brauner <brauner@kernel.org>
References: <20220420140633.753772-1-stefanb@linux.ibm.com>
 <20220420140633.753772-5-stefanb@linux.ibm.com>
 <20220521024633.GB9107@mail.hallyn.com>
From:   Stefan Berger <stefanb@linux.ibm.com>
In-Reply-To: <20220521024633.GB9107@mail.hallyn.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 5/20/22 22:46, Serge E. Hallyn wrote:
> On Wed, Apr 20, 2022 at 10:06:11AM -0400, Stefan Berger wrote:

>> @@ -1005,7 +1003,8 @@ void ima_update_policy(struct ima_namespace *ns)
>>   		 * on boot.  After loading a custom policy, free the
>>   		 * architecture specific rules stored as an array.
>>   		 */
>> -		kfree(arch_policy_entry);
>> +		kfree(ns->arch_policy_entry);
>> +		ns->arch_policy_entry = NULL;
> 
> So the thing that prevents multiple racing occurances of the above two lines is
> that ima_open_policy() sets IMA_FS_BUSY (or returns EBUSY) and then removes
> this file before clearing the flag, right?

Correct.

> 
> Seems good.
> 
> Reviewed-by: Serge Hallyn <serge@hallyn.com>
> 
> 
>>   	}
>>   	ima_update_policy_flags(ns);
>>   
>> -- 
>> 2.34.1