[RFC][PATCH v3 02/10] ima: Nest iint mutex for DIGEST_LIST_CHECK hook

[Roberto Sassu]

From: Roberto Sassu <roberto.sassu@xxxxxxxxxx>

Invoking digest_cache_get() inside the iint->mutex critical region can
cause deadlocks due to the fact that IMA can be recursively invoked for
reading the digest list. The deadlock would occur if the Integrity Digest
Cache attempts to read the same inode that is already locked by IMA.

However, since the Integrity Digest Cache makes sure that the above
situation never happens, as it checks the inodes, it is safe to call
digest_cache_get() inside the critical region and nest the iint->mutex
when the DIGEST_LIST_CHECK hook is executed.

Change the mutex_lock() call for the iint mutex into mutex_lock_nested(),
and add a subclass that is 0 if the IMA hook executed is not
DIGEST_LIST_CHECK, and 1 if it is.

Specifying the subclass does not interfere with the class annotation in
ima_iint_lockdep_annotate(), to make IMA work with overlayfs.

Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
---
 security/integrity/ima/ima_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index cff8b5a12512..06ee99bd7886 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -266,7 +266,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
 	if (!action)
 		goto out;
 
-	mutex_lock(&iint->mutex);
+	mutex_lock_nested(&iint->mutex, func == DIGEST_LIST_CHECK);
 
 	if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))
 		/* reset appraisal flags if ima_inode_post_setattr was called */
-- 
2.34.1