The warning has to do with the memory allocation order being above the max order supported for kmalloc. I think the problem is that ima_alloc_data_entry() is using kmemdup() to duplicate a payload of arbitrary size. Policies on e.g. Fedora can be quite large, so you can't assume they can be allocated with kmalloc and friends.[ 68.870715] irq event stamp: 23486085
[ 68.870715] hardirqs last enabled at (23486085):
[ 68.870715] hardirqs last disabled at (23486084):
[ 68.870715] softirqs last enabled at (23486074):
[ 68.870715] softirqs last disabled at (23486067):
[ 68.870715] ---[ end trace fb02740ff6f4d0cd ]---
I think one issue here is that systemd loads SELinux policy first, then IMA policy, so it doesn't know whether it needs to measure SELinux policy on first policy load, and another issue is that the policy is too large to just queue the policy data itself this way (or you need to use an allocator that can handle larger sizes).
The problem seems to be that a lock is held when the IMA hook to measure the LSM state is called. So memory allocation is not allowed, but the hook is doing an allocation. I'll address this - thanks for catching it.
I have the following CONFIGs enabled, but I still don't see the above issue on my machine.