Re: [GIT PULL] Security subsystem updates for 4.14

From: Christoph Hellwig
Date: Fri Sep 08 2017 - 03:09:52 EST

The reason why I send out the original version of this patch
is because IMA used to call ->read under i_rwsem, and that deadlocked
on XFS and NFS, or ext3/4 with DAX. The call path for that is

process_measurement (takes i_rwsem)
-> ima_collect_measurement
-> ima_calc_file_hash
-> ima_calc_file_ahash / ima_calc_file_shash
-> ima_calc_file_hash_atfm / ima_calc_file_hash_tfm
-> integrity_kernel_read

ima_check_last_writer (takes i_rwsem)
-> ima_update_xattr
-> ima_collect_measurement
-> (as above)

But yes, for the init-time integrity_read_file this is incorrect.
It never tripped up, and I explicitly added the lockdep annotations
so that anything would show up, and it's been half a year since
I sent that first RFC patch..