Beta Branch fix cmsec dmotd showing stale CVE verdict after kernel reboot in 140.00beta01

fix cmsec dmotd showing stale CVE verdict after kernel reboot in 140.00beta01

After updating to a patched kernel and rebooting, the first SSH login
banner kept reporting VULNERABLE for cmsec-checked CVEs even though the
running kernel was actually patched. The fresh-run path (cmsec check ...)
correctly reported PATCHED — only the dmotd login banner was wrong.

Root cause: lib/cache.sh cmsec_cache_read_stale() returned the prior
cached payload regardless of state-key match. The stale-fallback path
in cmsec.sh run_check_cached() exists to keep dmotd login fast under
flock contention (TTL expired or write in flight), but it was firing on
state changes too. After a reboot, the new kernel's state_key didn't
match the cached one, so the fresh-cache read failed — and the stale
fallback then served the pre-update VULNERABLE verdict to dmotd while
async-refreshing the cache. Second SSH login showed the correct PATCHED
verdict, but first login was misleading.

Same logic affects any state change: kernel reboot, livepatch applied,
OS conversion (migrate2alma/migrate2rocky), check script updated via
cmupdate, baseline manifest updated. EL8 / EL9 / EL10 / Linode kernels
all hit the same path.

---

Changes:
- cmsec_cache_read_stale() in lib/cache.sh now takes an optional
state_key argument; when supplied, returns the cached payload ONLY
if the stored state_key matches. Empty/omitted state_key preserves
legacy unconditional read for any future caller.
- run_check_cached() in cmsec.sh passes the current state_key to
cmsec_cache_read_stale. On state mismatch the stale-fallback now
refuses to return, falling through to a synchronous run_check_fresh
so dmotd reflects the actual current system state on the first
login after a state change.
- TTL-only expiry (state still matches) still uses stale + async
refresh as before — login stays fast in the common case.

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01