【openEuler 21.09】关闭IMA namespace编译选项时，导入IMA摘要列表可导致内核崩溃

【标题描述】关闭IMA namespace编译选项时，导入IMA摘要列表可导致内核崩溃
【环境信息】
硬件信息：无特殊硬件要求
软件信息：打开IMA启动参数开关
【问题复现步骤】
1. setup_grub2 measurement+appraisal `uname -r`
2. drauct -f -e xattr
3. reboot
4. echo /etc/ima/digest_lists/0-metadata-xxx-rpm-xxx > /sys/kernel/security/ima/digest_list_data
【预期结果】
不会导致内核崩溃
【实际结果】
内核崩溃
【附件信息】
vmcore信息如下：
```
[  398.307533] Call Trace:
[  398.307720]  xattr_verify.constprop.0+0x50/0x170
[  398.307878]  ima_appraise_measurement+0x4d6/0x7d0
[  398.307998]  process_ns_measurement+0x82e/0x900
[  398.308115]  ? touch_atime+0x33/0x140
[  398.308283]  ? generic_file_buffered_read+0x2ea/0x420
[  398.308396]  ? vmap_small_pages_range_noflush+0xed/0x130
[  398.308508]  process_measurement+0xaa/0xf0
[  398.308646]  ima_post_read_file+0xd5/0xf0
[  398.308811]  kernel_read_file+0x220/0x280
[  398.308924]  ima_read_sfs_file.constprop.0+0xa4/0x240
[  398.309083]  ima_write_data+0x255/0x2f0
[  398.309236]  ? security_file_permission+0x2c/0x140
[  398.309350]  vfs_write+0xc3/0x270
[  398.309444]  ksys_write+0x5f/0xe0
[  398.309571]  do_syscall_64+0x33/0x40
[  398.309676]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  398.309803] RIP: 0033:0x7f617a2c2277
[  398.309930] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[  398.310264] RSP: 002b:00007ffc422bdf58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  398.312089] RAX: ffffffffffffffda RBX: 0000000000000046 RCX: 00007f617a2c2277
[  398.313652] RDX: 0000000000000046 RSI: 00005584c3896a60 RDI: 0000000000000001
[  398.315140] RBP: 00005584c3896a60 R08: 00007f617a376000 R09: 00007f617a376080
[  398.316601] R10: 00007f617a375f80 R11: 0000000000000246 R12: 0000000000000046
[  398.318066] R13: 00007f617a3b75a0 R14: 0000000000000046 R15: 00007f617a3b77a0
[  398.319546] Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nft_objref nf_conntrack_tftp tun bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security rfkill ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter sunrpc intel_rapl_msr intel_rapl_common sb_edac kvm_intel kvm irqbypass virtio_balloon sg joydev i2c_piix4 pcspkr fuse ip_tables ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi ata_generic bochs_drm drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec crct10dif_pclmul drm_ttm_helper crc32_pclmul crc32c_intel ttm drm ata_piix ghash_clmulni_intel virtio_net net_failover failover serio_raw virtio_scsi libata
[  398.320408]  dm_mirror dm_region_hash dm_log dm_mod
[  398.334480] CR2: 0000000000000090
```

GVP openEuler/kernel

Content Risk Flag

Comments (1)

GVPopenEuler/kernel

Content Risk Flag