From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.42 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793394616; b=HoG90UjFL30R4ygj7+1IPp4fWrDz+xnVm+fPLDOnJ/y/IJUdzMnroezThSWlnt72H2Wz R1ESH6UrNIWPUKQiko4uH1LOshL0l+QOV5441TZxQf416l1s0B1zTZoiCttGSFmEHVYPF 6Kq3Ml+owcE3lSEUKoz9RwQrrm/4d7TQQtQzvsF5PsozfEUsTkfO3hJy04+Be1z2WEHkZ +TehzdjYqBBApC8zbbLOf2wvnrR77quQxpw+ZaGOmqZtQvfU/XPGhbTDP9vtJ2bujXLq6 sm8i/fmbn/aZ/+UoJqYkiKZGz8JjcogLR46AtNY6NLQaV+WYK37OgFvy1paVlKef/mQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793394616; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=GEs52XSVkXr3Lysumh8vBcPCuRt3C+96FDYzKDRWk9o=; b=BosAhLSQdq7qX6ivUI2Ar3BNzLhV9nyOenlQjTkQ0JXZXFn6AlFWIjp+X1LyrDkrlLRO p72NhJY4BGLa2zmv/eMq8wq65SxEC08qMdjpuyWmY0zpn+2CDEQ4uIgXHJosIZvl0Do/F 4B0SZqmvX+Mn0L5ccKE3Pw7/5wplv1uA1wXn3+IcMOX9lt1adQs5OtKHvBWJ8VuymB9U4 JNynQMmQJYGfrivHRLO9n/ul0RLJwkxTD6ly6S+88im5jiLw/5K1UinM7ch0X4Hx1eML2 fB7my3qa8zTQjnMBxOYB+t5gBwfWKyhKeoIaR53Jj6Y3hYVqGoboBlPmOby1HtJ/n+Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=arista.com; spf=pass smtp.mailfrom=arista.com; dkim=pass header.d=arista.com header.i=@arista.com header.a=rsa-sha256 header.s=google header.b=T8Rv2qIG; arc=none smtp.remote-ip=74.125.82.42 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23E07606A32F for ; Fri, 30 Oct 2026 21:10:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 23E07606A32F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=arista.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arista.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=arista.com header.i=@arista.com header.a=rsa-sha256 header.s=google header.b=T8Rv2qIG Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-14fc585291cso1060407c88.1 for ; Fri, 30 Oct 2026 14:10:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1793394614; x=1793999414; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GEs52XSVkXr3Lysumh8vBcPCuRt3C+96FDYzKDRWk9o=; b=T8Rv2qIGkZSI3KgoQ+cTGx4+bgXGd8WYNQ5lR46WQZvuOnZX3V48ggLUEp6l0WMJcv 6Ca2MKTHWA52a1MHs8UI6ldMUudkELX0cmFn6FkgsHJnKrDLna/soV7go2c8P3w2amlP XIhPAlza8W7dTt/OCpYzvmD/gnS9By5nqF3GojGBOjwq3ERq+VYpPFeBPf6Q+hXW1NI5 VqjFQK3PmN5I5sj++Qu4mXAF6Sxdl/Wiho2uHHd3v45rLSzMFkXQCoWMrU2Bjtmj4pdR b6xgxQA2Svnn5Pzcqh6vTiHg7erDcCWyAUIU1cHhMFgRpxw0KI3cvtR82scnZgm9oZNY FgPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793394614; x=1793999414; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=GEs52XSVkXr3Lysumh8vBcPCuRt3C+96FDYzKDRWk9o=; b=vd/naOj8A0VF8PBJwyjT1DKM1KnoriageEkLvvhDgaJpLGpzmpH3yzD5oJdsYd1zy+ zFQPP7V66qgLTphfaxj5YglbIQc+rwkF4TUzvdHiQ2Lba+WMwq6ujF7jL0hk2XCEmwPZ sibhzSPQJM6wIJwFHi0Eqg3XFIkJhBnzKZDTY+XstRJunojL8A8q3EcRfjGG/UKGPvc4 Mv5NQ5GKrTo0Fps/HAtmrBHQaIuQwdCdb2Q7517f7NaCzSTxu+tY9/e0PvqVn2yK66Pg V0jpKp6bIl6PsTdNiYof3oa1/XZz0fgl82bpLdVTZOcaGp4lPMTQ6jbLmyeZNx+Jaezp 0LPQ== X-Forwarded-Encrypted: i=1; AKwUvByDGshouhHwc0YrlUf7XkbJ/2e9PiThR35Voo0o2RUPzpi8myTfQBgefZ32wPSsV5YIoahUZJaZpN/RMgo=@vger.kernel.org X-Gm-Message-State: AFq9FYLWHA6I9jb9eXGoCkPWP6Hq7d255PbX0iMRVFYYmKd2lpLk5gcz IxoWCiEo9t4uykKHKIITAFrdNv82KonAaZ1iLnq+wLlhu8EwwI2HBG+XsljCLU6WjQ== X-Gm-Gg: AYBFou3D1TszAR7RMBIN+S3pjKZYDZlz3if3j53ZLJJlTe2sbU1V0lSl0mBVIBEMYnO l61tR/4XBWqlH0goX2/0+woqO/sJ1UtV00Ol0awGkO+HaaEPUBDwwYUvSrciR/Mynp1rVNQSPj4 C5SJ87melbZYJQHM9WHcsbngciXyxvpnztNnCAekVtII2tp250JRyDAxHow8jYeWjh7VK5W+qtd eIqYJ5UU69w5jXT5zKTKKhy/sDyPKQRnV46w80LSxZdCPQ4hsxuTUmoK8FjhVoSPp3AODJnWiRw w7cdXDSjTaULnOVRPSnboj7aoFNqlfz0XVVXN35KhuKHgXKq/uWqNig4H5q3R0EEbn4aXJItVQa Ag3fjQ6P7thXtWOqGYNNJ3NQuHX5aKwNzMlIZxha0lWxAuAlFywjXDqY/9R85k4rsSzgzRhZ1NA xJgsRmD1K7ZnVcL7Lleki7iSz4V3ho9fX+fCqrk2yCE3v3MPXGOaQXQGOyNF+GYE3uza5gO2IvH vPsKqb55QjoKrIxMbRTNBQLdNV1hm4LfuN7NVIRvOcK6RHXMCnefx2pqGww00sFwg1+wpLP7wSi 4832YoWF7F8913R4Sp7rusrtUmoD9S4yyc3PVChNzX+NWNgzDAqQQAPmhwWxLWut2/XjROQOemP nogUXm/CO2814SILTrh48Gw4= X-Received: by 2002:a05:7022:3f0d:b0:196:7742:3928 with SMTP id a92af1059eb24-1ac4fb0c862mr4604513c88.0.1793394613926; Fri, 30 Oct 2026 14:10:13 -0700 (PDT) Received: from dannyhu-upstreamLinux.sjc.aristanetworks.com ([74.123.28.18]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1ac1abcf67csm9471777c88.21.2026.10.30.14.10.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 14:10:13 -0700 (PDT) From: Danny Hu To: Alexander Viro , Christian Brauner Cc: Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Eric Snowberg , Jan Kara , Victor Kamensky , Taras Kondratiuk , Tianxing Zhang , Zheng Zengkai , zhoushuiqing , zhangguangzhi , Danny Hu , Jason Yan , silviu.vlasceanu@huawei.com, hpa@zytor.com, arnd@arndb.de, rob@landley.net, james.w.mcmechan@gmail.com, niveditas98@gmail.com, pierre@arista.com, julien@arista.com, kbharathi@arista.com, erosca@de.adit-jv.com, alexandr.lobakin@intel.com, jim_baxter@mentor.com, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kbuild@vger.kernel.org, initramfs@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, bug-cpio@gnu.org Subject: [PATCH v5 1/4] ima: skip algorithm availability check until initramfs unpacking is finished Date: Fri, 30 Oct 2026 14:09:40 -0700 Message-ID: <20261030210944.2143778-2-dannyhu@arista.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20261030210944.2143778-1-dannyhu@arista.com> References: <20261030210944.2143778-1-dannyhu@arista.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit With CONFIG_IMA_APPRAISE=y, restoring xattrs during initramfs unpacking can deadlock the kernel if the xattr being restored is signed with a hash that the kernel does not already have available. This occurs when the ima_inode_setxattr() hook calls crypto_has_alg(). crypto_has_alg() may synchronously request a module leading to a circular dependency where the userspace helper waits for initramfs unpacking to complete while initramfs unpacking waits for the userspace helper. Guard this crypto availability check in validate_hash_algo() until initramfs unpacking is complete. This prevents the kernel from requesting a module during unpacking and allows security.ima xattrs to be restored even if the hash algorithm is unavailable in the running kernel. Essentially, this flag distinguishes restoration of existing metadata during initial population from setting/changing an xattr during runtime. A benefit of this approach is that once unpacking is complete, all subsequent xattr updates go through the same codepath as before which preserves the existing behavior during normal userspace operation. Signed-off-by: Danny Hu --- security/integrity/ima/ima_appraise.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 63b0cb957c65..1403f5653973 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -20,6 +20,14 @@ #include "ima.h" +static bool ima_initramfs_populated __ro_after_init = + !IS_ENABLED(CONFIG_BLK_DEV_INITRD); + +static void ima_notify_initramfs_populated(void) +{ + ima_initramfs_populated = true; +} + #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM static char *ima_appraise_cmdline_default __initdata; core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0); @@ -738,6 +746,22 @@ static int validate_hash_algo(struct dentry *dentry, if (likely(xattr_hash_algo == ima_hash_algo)) return 0; + /* + * IMA validates the crypto algorithm whenever the security.ima + * xattr is set. Restoring xattrs during initramfs unpacking + * can call crypto_has_alg() before unpacking has completed. + * + * If the algo is unavailable, crypto_has_alg() may + * synchronously request a module. The userspace helper waits + * for initramfs unpacking to finish and creates a circular + * dependency. + * + * Skip the algorithm availability check until initramfs is + * populated to avoid this deadlock. + */ + if (!ima_initramfs_populated) + return 0; + /* allow any xattr using an algorithm built in the kernel */ if (crypto_has_alg(hash_algo_name[xattr_hash_algo], 0, 0)) return 0; @@ -829,6 +853,7 @@ static struct security_hook_list ima_appraise_hooks[] __ro_after_init = { LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl), LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr), LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl), + LSM_HOOK_INIT(initramfs_populated, ima_notify_initramfs_populated), }; void __init init_ima_appraise_lsm(const struct lsm_id *lsmid) -- 2.51.0