Stable team,
Please backport these upstream commits to stable kernels: - c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()"
Dependency on: - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
Known minor merge conflicts: - Commit: 65603435599f ("ima: Fix trivial typos in the comments") fixed "refrences" spelling, causes a merge conflict. - Commit 28073eb09c5a ("ima: Fix fall-through warnings for Clang") adds a "break;" before "default:", causes a merge conflict.
Simplifies backporting to linux-5.4.y: - 465aee77aae8 ("ima: Free the entire rule when deleting a list of rules") except for the line "kfree(entry->keyrings);" - introduced in 5.6.y. - 39e5993d0d45 ("ima: Shallow copy the args_p member of ima_rule_entry.lsm elements") - b8867eedcf76 ("ima: Rename internal filter rule functions") - f60c826d0318 ("ima: Use kmemdup rather than kmalloc+memcpy")
A patch for kernels prior to commit b16942455193 ("ima: use the lsm policy update notifier") will be posted separately.
thanks,
Mimi
On Wed, Dec 21, 2022 at 09:50:09AM -0500, Mimi Zohar wrote:
Stable team,
Please backport these upstream commits to stable kernels:
- c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"
Dependency on:
- d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
Known minor merge conflicts:
- Commit: 65603435599f ("ima: Fix trivial typos in the comments") fixed
"refrences" spelling, causes a merge conflict.
- Commit 28073eb09c5a ("ima: Fix fall-through warnings for Clang") adds
a "break;" before "default:", causes a merge conflict.
Simplifies backporting to linux-5.4.y:
- 465aee77aae8 ("ima: Free the entire rule when deleting a list of
rules") except for the line "kfree(entry->keyrings);" - introduced in 5.6.y.
- 39e5993d0d45 ("ima: Shallow copy the args_p member of
ima_rule_entry.lsm elements")
- b8867eedcf76 ("ima: Rename internal filter rule functions")
- f60c826d0318 ("ima: Use kmemdup rather than kmalloc+memcpy")
I'm sorry, but I'm confused.
What exact commits are needed in what order for which stable trees?
A patch for kernels prior to commit b16942455193 ("ima: use the lsm policy update notifier") will be posted separately.
But that commit has been backported to 4.19.y and newer stable trees, right?
confused,
greg k-h
Hi Greg,
On Wed, 2022-12-21 at 19:22 +0100, Greg KH wrote:
On Wed, Dec 21, 2022 at 09:50:09AM -0500, Mimi Zohar wrote:
Stable team,
Please backport these upstream commits to stable kernels:
- c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"
Dependency on:
- d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
Known minor merge conflicts:
- Commit: 65603435599f ("ima: Fix trivial typos in the comments") fixed
"refrences" spelling, causes a merge conflict.
- Commit 28073eb09c5a ("ima: Fix fall-through warnings for Clang") adds
a "break;" before "default:", causes a merge conflict.
Up to linux-5.9.y, there are two merge conflicts - a spelling error and a missing "break" before "default:", which are the result of the above commits. Otherwise the two commits apply cleanly: - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule") - c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()"
Simplifies backporting to linux-5.4.y:
- 465aee77aae8 ("ima: Free the entire rule when deleting a list of
rules") except for the line "kfree(entry->keyrings);" - introduced in 5.6.y.
- 39e5993d0d45 ("ima: Shallow copy the args_p member of
ima_rule_entry.lsm elements")
- b8867eedcf76 ("ima: Rename internal filter rule functions")
- f60c826d0318 ("ima: Use kmemdup rather than kmalloc+memcpy")
I'm sorry, but I'm confused.
What exact commits are needed in what order for which stable trees?
The above 4 commits are needed, in the order listed, for linux-5.4.y before applying these two commits: - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule") - c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()"
A patch for kernels prior to commit b16942455193 ("ima: use the lsm policy update notifier") will be posted separately.
But that commit has been backported to 4.19.y and newer stable trees, right?
No, b16942455193 ("ima: use the lsm policy update notifier") was upstreamed in linux-5.3.y and has not been backported to linux-4.19.y. We're still determining for linux-4.19.y the best way to address the bug that commit c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()") addresses.
confused,
I hope this clarifies things...
On Wed, Dec 21, 2022 at 01:52:09PM -0500, Mimi Zohar wrote:
Hi Greg,
On Wed, 2022-12-21 at 19:22 +0100, Greg KH wrote:
On Wed, Dec 21, 2022 at 09:50:09AM -0500, Mimi Zohar wrote:
Stable team,
Please backport these upstream commits to stable kernels:
- c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"
Dependency on:
- d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
Known minor merge conflicts:
- Commit: 65603435599f ("ima: Fix trivial typos in the comments") fixed
"refrences" spelling, causes a merge conflict.
- Commit 28073eb09c5a ("ima: Fix fall-through warnings for Clang") adds
a "break;" before "default:", causes a merge conflict.
Up to linux-5.9.y, there are two merge conflicts - a spelling error and a missing "break" before "default:", which are the result of the above commits. Otherwise the two commits apply cleanly:
- d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
- c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"
Again, this isn't going to work, I need backported commits that have been tested and verified to work please.
Simplifies backporting to linux-5.4.y:
- 465aee77aae8 ("ima: Free the entire rule when deleting a list of
rules") except for the line "kfree(entry->keyrings);" - introduced in 5.6.y.
- 39e5993d0d45 ("ima: Shallow copy the args_p member of
ima_rule_entry.lsm elements")
- b8867eedcf76 ("ima: Rename internal filter rule functions")
- f60c826d0318 ("ima: Use kmemdup rather than kmalloc+memcpy")
I'm sorry, but I'm confused.
What exact commits are needed in what order for which stable trees?
The above 4 commits are needed, in the order listed, for linux-5.4.y before applying these two commits:
- d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
- c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"
A patch for kernels prior to commit b16942455193 ("ima: use the lsm policy update notifier") will be posted separately.
But that commit has been backported to 4.19.y and newer stable trees, right?
No, b16942455193 ("ima: use the lsm policy update notifier") was upstreamed in linux-5.3.y and has not been backported to linux-4.19.y. We're still determining for linux-4.19.y the best way to address the bug that commit c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()") addresses.
It would be easiest if you just send a series of backported commits that you have tested, otherwise I will get the above instructions wrong :)
thanks,
greg k-h
linux-stable-mirror@lists.linaro.org
-
Greg KH -
Mimi Zohar