lkml.org 
[lkml]   [2018]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 0/2] turn on force option for FUSE in builtin policies
Hi,

On Thu, Jan 11, 2018 at 8:51 PM, Dongsu Park <dongsu@kinvolk.io> wrote:
> In case of FUSE filesystem, cached integrity results in IMA could be
> reused, when the userspace FUSE process has changed the
> underlying files. To be able to avoid such cases, we need to turn on
> the force option in builtin policies, for actions of measure and
> appraise. Then integrity values become re-measured and re-appraised.
> In that way, cached integrity results won't be used.

Since yesterday Alban and I have been working on a different approach
that does not depend on IMA rules, nor fsmagic. Please see:
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1587390.html

If that's ok, I'm ready to discard this patchset.

Thanks,
Dongsu

> This patchset depends on the patch "ima: define a new policy option
> named force" by Mimi. [1] For details on testing the force option,
> please refer to the testing report by Alban. [2]
>
> The first patch is for simply moving FUSE_*SUPER_MAGIC macros to
> include/uapi/linux, to be able to use those in other subsystems like
> security/integrity/ima.
>
> The second patch is actually to turn on the force option for FUSE fs
> in IMA.
>
> [1] https://www.spinics.net/lists/linux-integrity/msg00948.html
> [2] https://marc.info/?l=linux-integrity&m=151559360514676&w=2
>
>
> Dongsu Park (2):
> fs/fuse: move SUPER_MAGIC definitions to linux/magic.h
> ima: turn on force option for FUSE in builtin policies
>
> fs/fuse/control.c | 3 +--
> fs/fuse/inode.c | 3 +--
> include/uapi/linux/magic.h | 3 +++
> security/integrity/ima/ima_policy.c | 2 ++
> 4 files changed, 7 insertions(+), 4 deletions(-)
>
> --
> 2.13.6
>

\
 
 \ /
  Last update: 2018-01-16 12:09    [W:0.569 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site