Re: [PATCH v4 1/2] ima: measure loaded policy after write on securityfs policy file

On Wed, 2026-06-24 at 16:35 -0400, Mimi Zohar wrote:
[...]

> > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> > index f7f940a76922..0a70d10da70a 100644
> > --- a/security/integrity/ima/ima_policy.c
> > +++ b/security/integrity/ima/ima_policy.c
> 
> > @@ -2379,3 +2378,70 @@ bool ima_appraise_signature(enum kernel_read_file_id id)
> >  	return found;
> >  }
> >  #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */
> > +
> > +/**
> > +* ima_measure_loaded_policy - measure the active IMA policy ruleset
> > +*
> > +* Must be called with ima_write_mutex held, as it performs two
> > +* separate RCU read passes over ima_rules and relies on the mutex
> > +* to prevent concurrent policy updates between them.
> > +*/

Hi Enrico,

I forgot to mention that the kernel-doc formatting is off.  Refer to
checkpatch.pl for the details.  Either change it to a regular comment or format
it properly.

thanks,

Mimi
>