Bug 1226948 - systemd loading IMA policy
Summary: systemd loading IMA policy
Alias: None
Product: Fedora
Classification: Fedora
Component: systemd
Version: 22
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: systemd-maint
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2015-06-01 13:51 UTC by zohar
Modified: 2015-07-14 15:31 UTC (History)
8 users (show)

Fixed In Version: systemd-219-19.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1243010 (view as bug list)
Last Closed: 2015-07-14 15:31:49 UTC
Type: Bug

Attachments (Terms of Use)

Description zohar 2015-06-01 13:51:41 UTC
The original systemd IMA module loaded the IMA policy by mmaping the
file into memory and then writing the entire file to
<securityfs>/ima/policy.  By changing this behavior of writing the
entire file,  commit 4dfb18922d5d "ima-setup: simplify"  broke IMA
policy loading.

Version-Release number of selected component (if applicable):

Fedora 22: systemd src/core/ima-setup.c

How reproducible:


Steps to Reproduce:
1. On boot with an IMA policy in /etc/ima/ima-policy (default location)

Actual results:

systemd[1]: Failed to load the IMA custom policy file /etc/ima/ima-policy: Invalid argument
IMA: policy updated failed
[!!!!!!] Failed to load IMA policy, freezing

Expected results:
systemd[1]: Successfully loaded the IMA custom policy /etc/ima/ima-policy
kernel: IMA: policy update completed

Additional info:
Please revert commit 4dfb18922d5d1efb13ee459cbf23832277f85ed7 and the
related hunk in commit 7430ec6ac08f2c0416d9f806964c46b30f3862b2.

This bug was reported by Patrick Ohly.

Comment 1 zohar 2015-06-02 12:08:12 UTC
"[PATCH] Partially revert "ma-setup: simplify" by Zbigniew Jędrzejewski-Szmek http://lists.freedesktop.org/archives/systemd-devel/2015-June/032632.html fixes the regression.

Please pick up the patch.

Comment 2 Zbigniew Jędrzejewski-Szmek 2015-06-13 03:54:06 UTC
https://github.com/systemd/systemd/pull/167 merged.

Comment 3 Fedora Update System 2015-07-08 02:35:48 UTC
systemd-219-19.fc22 has been submitted as an update for Fedora 22.

Comment 4 Fedora Update System 2015-07-10 19:18:02 UTC
Package systemd-219-19.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing systemd-219-19.fc22'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2015-07-14 15:31:49 UTC
systemd-219-19.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.