[lkml]   [2009]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] integrity: fix IMA inode leak
    On Sat, 2009-06-06 at 14:18 -0700, Linus Torvalds wrote:
    > On Sat, 6 Jun 2009, Hugh Dickins wrote:
    > >
    > > CONFIG_IMA=y inode activity leaks iint_cache and radix_tree_node objects
    > > until the system runs out of memory. Nowhere is calling ima_inode_free()
    > > a.k.a. ima_iint_delete(). Fix that by calling it from destroy_inode().
    > Shouldn't we call it from "security_inode_free()" instead? And shouldn't
    > it be allocated in "security_inode_alloc()"? That sounds like the correct
    > nesting here, since the whole integrity thing is under the security
    > module.
    > Hmm?
    > Linus

    Mandatory Access Control(MAC) modules (i.e. SELinux, smack, etc) and
    integrity (i.e IMA) are two different aspects of security. The LSM
    hooks, which includes security_inode_free(), are used to implement MAC,
    not integrity.

    Mimi Zohar

     \ /
      Last update: 2009-06-07 08:11    [W:0.019 / U:5.868 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site