Messages in this thread | | | Subject | Re: [PATCH] integrity: add ima_counts_put (updated) | From | Mimi Zohar <> | Date | Mon, 29 Jun 2009 18:04:20 -0400 |
| |
On Tue, 2009-06-30 at 05:36 +0900, hooanon05@yahoo.co.jp wrote: > Mimi Zohar: > > This suggestion has been mentioned before; and yes would definitely > > resolve the annoying imbalance and iint_free() messages. But > > incrementing/decrementing the pointers automatically each time a file is > > opened/closed would defeat their purpose - alerting us that a file was > > possibly not measured before being read/executed. > > I may be wrong since I don't fully understand IMA's purpose, but why did > you create ima_counts_get() and make it call after dentry_open() in > nfsd_open()? Isn't it same thing essentially? > > > J. R. Okajima
NFSv3 is an interesting example. Permission checking is done once, followed by multiple open/read/close calls. Incrementing the counters in nfsd_permission() once and decrementing the counters in close, multiple times, resulted in imbalance messages. True, the solution in this case was to increment in open and decrement in close, but that was only part of the solution. The other part of the solution, the important part, was to add a call to ima_path_check() to measure the file.
The imbalance message did what it was suppose to do - highlight the fact that a file was read/executed without first being measured.
Mimi
| |