[Cc'ing Lennart Poettering] On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote: > Prevent redundant IMA policy rules by checking for duplicates before > insertion. This ensures that > rules are not re-added when userspace is restarted (using > systemd-soft-reboot) without a full system > reboot. ima_rule_exists() detects duplicates in both temporary and active > rule lists. > > Signed-off-by: Tahera Fahimi <[email protected]>
Sorry for the delay in responding ... Before trying to fix the "problem", let's try to understand it first. At least on my test system (-rc5), kexec is working as designed. On boot, systemd replaces the existing builtin IMA policy with a custom IMA policy. The arch specific policies are not affected, as they are persistent. On a soft reboot (kexec), the IMA custom policy is re-loaded as expected. To verify the above behavior, extend the IMA policy before the soft reboot. Notice after the soft reboot that the original custom IMA policy is loaded and not the extended IMA policy. Roberto, if there is a problem with this behavior, we'll discuss it independently of this proposed patch. The question is why are you seeing duplicate IMA policy rules? What is special about your environment? -- thanks, Mimi
