On Tue, 2025-11-11 at 06:40 -0500, Mimi Zohar wrote: > [Cc'ing Lennart Poettering] > > On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote: > > Prevent redundant IMA policy rules by checking for duplicates before > > insertion. This ensures that > > rules are not re-added when userspace is restarted (using > > systemd-soft-reboot) without a full system > > reboot. ima_rule_exists() detects duplicates in both temporary and active > > rule lists. > > > > Signed-off-by: Tahera Fahimi <[email protected]> > > Sorry for the delay in responding ... > > Before trying to fix the "problem", let's try to understand it first. At > least > on my test system (-rc5), kexec is working as designed. On boot, systemd > replaces the existing builtin IMA policy with a custom IMA policy. The arch > specific policies are not affected, as they are persistent. On a soft reboot > (kexec), the IMA custom policy is re-loaded as expected. > > To verify the above behavior, extend the IMA policy before the soft reboot. > Notice after the soft reboot that the original custom IMA policy is loaded and > not the extended IMA policy. Roberto, if there is a problem with this > behavior, > we'll discuss it independently of this proposed patch. > > The question is why are you seeing duplicate IMA policy rules? What is > special > about your environment?
I'm now able to reproduce what you're seeing by executing "systemctl soft- reboot". After each soft-reboot the custom IMA policy rules are re-loaded and appended to the existing IMA policy. As Roberto mentioned, there is no option to replace the existing custom IMA policy rules with a new custom policy. We might consider doing so in the future, but for now the onus for not re-loading the custom IMA policy should not be on IMA, but on systemd. Reading the same securityfs policy file used for loading the IMA policy will return the current IMA policy. systemd could detect whether the existing IMA policy contains the custom policy rules, before actually loading them. There's no reason for adding this functionality in the kernel. -- thanks, Mimi
