Messages in this thread | | | Date | Fri, 15 May 2009 10:39:42 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH] IMA: do not measure everything opened by root by default |
| |
On Tue, 12 May 2009, Eric Paris wrote:
> The IMA default policy measures every single file opened by root. This is > terrible for most users. Consider a system (like mine) with virtual machine > images. When those images are touched (which happens at boot for me) those > images are measured. This is just way too much for the default case. > > Signed-off-by: Eric Paris <eparis@redhat.com>
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
> --- > > security/integrity/ima/ima_policy.c | 2 -- > 1 files changed, 0 insertions(+), 2 deletions(-) > > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > index b168c1d..dec6dcb 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > @@ -61,8 +61,6 @@ static struct ima_measure_rule_entry default_rules[] = { > .flags = IMA_FUNC | IMA_MASK}, > {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, > .flags = IMA_FUNC | IMA_MASK}, > - {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0, > - .flags = IMA_FUNC | IMA_MASK | IMA_UID} > }; > > static LIST_HEAD(measure_default_rules); >
-- James Morris <jmorris@namei.org>
| |