diff options
| author | Frederick Lawler <fred@cloudflare.com> | 2025-03-27 11:09:11 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-29 11:02:00 +0200 |
| commit | 836917e7a65cd47d2d7cc2d46305573a155ffd5d (patch) | |
| tree | 7d3ef678d86f82edf89a4b90ccd2924455fd5def /fs/buffer.c | |
| parent | e22034cbee52b6c42e81960a09c6b2cef41187ed (diff) | |
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
[ Upstream commit 30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2 ]
On IMA policy update, if a measure rule exists in the policy,
IMA_MEASURE is set for ima_policy_flags which makes the violation_check
variable always true. Coupled with a no-action on MAY_READ for a
FILE_CHECK call, we're always taking the inode_lock().
This becomes a performance problem for extremely heavy read-only workloads.
Therefore, prevent this only in the case there's no action to be taken.
Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Acked-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/buffer.c')
0 files changed, 0 insertions, 0 deletions