lkml.org 
[lkml]   [2014]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 0/6] File Sealing & memfd_create()
    On 04/22/2014 01:55 PM, David Herrmann wrote:
    > Hi
    >
    > On Tue, Apr 22, 2014 at 11:10 AM, Florian Weimer <fweimer@redhat.com> wrote:
    >> Ah. What do you recommend for recipient to recognize such descriptors?
    >> Would they just try to seal them and reject them if this fails?
    >
    > This highly depends on your use-case. Please see the initial email in
    > this thread. It describes 2 example use-cases. In both cases, the
    > recipients read the current set of seals and verify that a given set
    > of seals is set.

    I didn't find that very convincing. But in v2, seals are monotonic, so
    checking them should be reliable enough.

    What happens when you create a loop device on a write-sealed descriptor?

    --
    Florian Weimer / Red Hat Product Security Team


    \
     
     \ /
      Last update: 2014-04-22 15:01    [W:4.618 / U:0.304 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site