With CONFIG_IMA_APPRAISE=y, restoring xattrs during initramfs unpacking can deadlock the kernel if the xattr being restored is signed with a hash that the kernel does not already have available. This occurs when the ima_inode_setxattr() hook calls crypto_has_alg(). crypto_has_alg() may synchronously request a module leading to a circular dependency where the userspace helper waits for initramfs unpacking to complete while initramfs unpacking waits for the userspace helper.
Guard this crypto availability check in validate_hash_algo() until initramfs unpacking is complete. This prevents the kernel from requesting a module during unpacking and allows security.ima xattrs to be restored even if the hash algorithm is unavailable in the running kernel. Essentially, this flag distinguishes restoration of existing metadata during initial population from setting/changing an xattr during runtime. A benefit of this approach is that once unpacking is complete, all subsequent xattr updates go through the same codepath as before which preserves the existing behavior during normal userspace operation. Signed-off-by: Danny Hu <[email protected]> --- security/integrity/ima/ima_appraise.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 63b0cb957c65..1403f5653973 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -20,6 +20,14 @@ #include "ima.h" +static bool ima_initramfs_populated __ro_after_init = + !IS_ENABLED(CONFIG_BLK_DEV_INITRD); + +static void ima_notify_initramfs_populated(void) +{ + ima_initramfs_populated = true; +} + #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM static char *ima_appraise_cmdline_default __initdata; core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0); @@ -738,6 +746,22 @@ static int validate_hash_algo(struct dentry *dentry, if (likely(xattr_hash_algo == ima_hash_algo)) return 0; + /* + * IMA validates the crypto algorithm whenever the security.ima + * xattr is set. Restoring xattrs during initramfs unpacking + * can call crypto_has_alg() before unpacking has completed. + * + * If the algo is unavailable, crypto_has_alg() may + * synchronously request a module. The userspace helper waits + * for initramfs unpacking to finish and creates a circular + * dependency. + * + * Skip the algorithm availability check until initramfs is + * populated to avoid this deadlock. + */ + if (!ima_initramfs_populated) + return 0; + /* allow any xattr using an algorithm built in the kernel */ if (crypto_has_alg(hash_algo_name[xattr_hash_algo], 0, 0)) return 0; @@ -829,6 +853,7 @@ static struct security_hook_list ima_appraise_hooks[] __ro_after_init = { LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl), LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr), LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl), + LSM_HOOK_INIT(initramfs_populated, ima_notify_initramfs_populated), }; void __init init_ima_appraise_lsm(const struct lsm_id *lsmid) -- 2.51.0
