On Fr, 07.11.25 10:44, Roberto Sassu ([email protected]) wrote:
> On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote: > > Prevent redundant IMA policy rules by checking for duplicates before > > insertion. This ensures that > > rules are not re-added when userspace is restarted (using > > systemd-soft-reboot) without a full system > > reboot. ima_rule_exists() detects duplicates in both temporary and active > > rule lists. > > + Lennart > > Hi Tahera > > thanks for the patch! > > Wouldn't be better to enhance systemd-soft-reboot to not send the same > IMA policy again? the soft-reboot logic doesn't load the IMA policy. It's just that soft-reboot means we reexec PID1: the old pid1 gets replaced by the new one. And that new PID1 then initializes as it usually would, and loads security policies again. It currently has support for selinux policies, ima, ipe, smack. These policies are supposed to *replace* whatever was loaded before. Looking at our IMA logic, this doesn't happen right now though, it just adds stuff: https://github.com/systemd/systemd/blob/main/src/core/ima-setup.c Is there a way to replace the old IMA policy with the new, with the current IMA userspace interface? If so, we should probably make use of that in systemd, and replace the policy that way. Or in other words: under the assumption that one can flush out the old IMA policy and replace it with a new one, I think this should be fixed in systemd, not the kernel. (of there's no api for flushing out the old policy/replacing it with the new, then of course we need something like that in the kernel first). My understanding of IMA is kinda limited though. I just know what we do in our codebase. Lennart
