On Thu, 2026-07-02 at 21:04 +0200, Enrico Bravi wrote:
> diff --git a/security/integrity/ima/ima_policy.c
> b/security/integrity/ima/ima_policy.c
> index f7f940a76922..a65b7e4b64d6 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -2379,3 +2385,82 @@ bool ima_appraise_signature(enum kernel_read_file_id
> id)
> return found;
> }
> #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */
> +
> +/**
> + * ima_measure_loaded_policy - measure the active IMA policy ruleset
> + *
> + * Must be called with ima_write_mutex held, as it performs two
> + * separate RCU read passes over ima_rules and relies on the mutex
> + * to prevent concurrent policy updates between them.
> + */
> +void ima_measure_loaded_policy(void)
> +{
> + const char *event_name = "ima_policy_loaded";
> + const char *op = "measure_loaded_ima_policy";
> + size_t rule_len = max_rule_len + 2;
> + struct ima_rule_entry *rule_entry;
> + struct list_head *ima_rules_tmp;
> + struct seq_file file;
Hi Enrico,
FYI, there's a merge conflict with commit 51bedcd803e0 ("ima: Mediate
open/release method of the measurements list".
As long as 2/2 needs to be update, there are two nits: initialize seq_file like
"file = { 0 };".
> + int result = -ENOMEM;
> + size_t file_len = 0;
> + char *rule;
> +
> + lockdep_assert_held(&ima_write_mutex);
> +
> + rule = vmalloc(rule_len);
> + if (!rule) {
> + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
> + op, "ENOMEM", result, 0);
> + return;
> + }
> +
> + /* calculate IMA policy rules memory size */
> + file.buf = rule;
> + file.read_pos = 0;
> + file.size = rule_len;
> + file.count = 0;
> +
> + rcu_read_lock();
> + ima_rules_tmp = rcu_dereference(ima_rules);
> + list_for_each_entry_rcu(rule_entry, ima_rules_tmp, list) {
> + ima_policy_show(&file, rule_entry);
> +
> + if (seq_has_overflowed(&file)) {
> + result = -E2BIG;
> + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL,
> event_name,
> + op, "rule_length", result, 0);
and limit the integrity_audit_msg to 80 chars.
Otherwise the patch looks good.
Mimi
> + rcu_read_unlock();
> + goto free_rule;
> + }
> +
> + file_len += file.count;
> + file.count = 0;
> + }
> + rcu_read_unlock();
> +
> + /* copy IMA policy rules to a buffer for measuring */
> + file.buf = vmalloc(file_len);
> + if (!file.buf) {
> + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
> + op, "ENOMEM", result, 0);
> + goto free_rule;
> + }
> +
> + file.read_pos = 0;
> + file.size = file_len;
> + file.count = 0;
> +
> + rcu_read_lock();
> + ima_rules_tmp = rcu_dereference(ima_rules);
> + list_for_each_entry_rcu(rule_entry, ima_rules_tmp, list) {
> + ima_policy_show(&file, rule_entry);
> + }
> + rcu_read_unlock();
> +
> + ima_measure_critical_data("ima_policy", event_name, file.buf,
> + file.count, false, NULL, 0);
> +
> + vfree(file.buf);
> +free_rule:
> + vfree(rule);
> +}
