lkml.org 
[lkml]   [2009]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] IMA: do not measure everything opened by root by default
On Tue, 12 May 2009, Eric Paris wrote:

> The IMA default policy measures every single file opened by root. This is
> terrible for most users. Consider a system (like mine) with virtual machine
> images. When those images are touched (which happens at boot for me) those
> images are measured. This is just way too much for the default case.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

> ---
>
> security/integrity/ima/ima_policy.c | 2 --
> 1 files changed, 0 insertions(+), 2 deletions(-)
>
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index b168c1d..dec6dcb 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -61,8 +61,6 @@ static struct ima_measure_rule_entry default_rules[] = {
> .flags = IMA_FUNC | IMA_MASK},
> {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
> .flags = IMA_FUNC | IMA_MASK},
> - {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0,
> - .flags = IMA_FUNC | IMA_MASK | IMA_UID}
> };
>
> static LIST_HEAD(measure_default_rules);
>

--
James Morris
<jmorris@namei.org>


\
 
 \ /
  Last update: 2009-05-15 02:43    [W:0.046 / U:0.776 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site