Messages in this thread | | | Subject | Re: [RFC PATCH 1/2] Fix 1 untangling ima mess, part 2 with counters | From | Mimi Zohar <> | Date | Mon, 25 Jan 2010 14:24:37 -0500 |
| |
On Sat, 2010-01-23 at 23:07 +0000, Al Viro wrote: > On Wed, Jan 20, 2010 at 03:35:40PM -0500, Mimi Zohar wrote: > > The "Untangling ima mess, part 2 with counters" patch messed > > up the counters. Based on conversations with Al Viro, this patch > > streamlines ima_path_check() by removing the counter maintaince. > > The counters are now updated independently, from measuring the file, > > in __dentry_open() and alloc_file() by calling ima_counts_get(). > > ima_path_check() is called from nfsd and do_filp_open(). > > > > Signed-off-by: Mimi Zohar <zohar@us.ibm.com> > > --- > > fs/namei.c | 4 +- > > include/linux/ima.h | 4 +- > > security/integrity/ima/ima_main.c | 234 ++++++++++++++----------------------- > > Um... > a) where's the nfsd part? > b) will that work if we open file with O_WRONLY?
Files opened O_WRONLY are not measured.
> nfsd side of things is non-trivial. Note that you have that thing called > an awful lot; nfsd_permission() is called by fh_verify(). For which > operations do you really want it to happen? Should it just migrate to > nfsd_open()?
The IMA counters are updated in alloc_file() and __dentry_open(). __dentry_open() is called from a couple of places: lookup_instantiate_filp(), nameidata_to_filp() and dentry_open. Of these calls, files are only being measured in the nameidata_to_filp() path. So yes, the current ima_path_check() needs to be moved to after the dentry_open() in nfsd_open(), and also added after each of the other dentry_open() and lookup_instantiate_filp() calls. Otherwise the counters will be correct, but the files will not be measured.
Eric's proposed patches had two calls to ima_path_check(). Was sure looking forward to not having to add ima_path_check() calls all over.
Mimi
| |