[PATCH v5 2/2] ima: Handle -ESTALE returned by ima_filter_rule_match()

[Roberto Sassu]

On Wed, 2022-09-28 at 10:11 -0400, Mimi Zohar wrote:
> On Sat, 2022-09-24 at 14:05 +0800, Guozihua (Scott) wrote:
> 
> > I might have overlooked something, but if I understands the code 
> > correctly, we would be copying the same rule over and over again
> > till 
> > the loop ends in that case. ima_lsm_update_rule() would replace the
> > rule 
> > node on the rule list without updating the rule in place. Although 
> > synchronize_rcu() should prevent a UAF, the rule in
> > ima_match_rules() 
> > would not be updated. Meaning SELinux would always return -ESTALE
> > before 
> > we copy and retry as we keep passing in the outdated rule entry.
> 
> After reviewing this patch set again, the code looks fine.  The
> commit
> message is still a bit off, but I've pushed the patch set out to
> next-
> integrity-testing, waiting for some Reviewed-by/Tested-by tags.

The patches look ok for me. For both:

Reviewed-by: Roberto Sassu <roberto.sassu at huawei.com>

Roberto