diff options
| author | Frederick Lawler <fred@cloudflare.com> | 2025-03-27 11:09:11 -0500 |
|---|---|---|
| committer | Roberto Sassu <roberto.sassu@huawei.com> | 2025-04-22 16:39:32 +0200 |
| commit | 30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2 (patch) | |
| tree | 2d530ebf3a0d053e068146932c307007fa25f188 /rust/helpers/platform.c | |
| parent | 9c32cda43eb78f78c73aee4aa344b777714e259b (diff) | |
| download | linux-30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2.tar.gz linux-30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2.tar.bz2 linux-30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2.zip | |
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
On IMA policy update, if a measure rule exists in the policy,
IMA_MEASURE is set for ima_policy_flags which makes the violation_check
variable always true. Coupled with a no-action on MAY_READ for a
FILE_CHECK call, we're always taking the inode_lock().
This becomes a performance problem for extremely heavy read-only workloads.
Therefore, prevent this only in the case there's no action to be taken.
Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Acked-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'rust/helpers/platform.c')
0 files changed, 0 insertions, 0 deletions