[PATCH v5 2/2] ima: Handle -ESTALE returned by ima_filter_rule_match()

[Mimi Zohar]

On Sat, 2022-09-24 at 14:05 +0800, Guozihua (Scott) wrote:

> I might have overlooked something, but if I understands the code 
> correctly, we would be copying the same rule over and over again till 
> the loop ends in that case. ima_lsm_update_rule() would replace the rule 
> node on the rule list without updating the rule in place. Although 
> synchronize_rcu() should prevent a UAF, the rule in ima_match_rules() 
> would not be updated. Meaning SELinux would always return -ESTALE before 
> we copy and retry as we keep passing in the outdated rule entry.

After reviewing this patch set again, the code looks fine.  The commit
message is still a bit off, but I've pushed the patch set out to next-
integrity-testing, waiting for some Reviewed-by/Tested-by tags.

-- 
thanks,

Mimi