Linux-Fsdevel Archive on lore.kernel.org
help / color / mirror / Atom feed
* [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
@ 2018-01-16 15:10 Alban Crequy
  2018-01-18 21:25 ` Mimi Zohar
  0 siblings, 1 reply; 6+ messages in thread
From: Alban Crequy @ 2018-01-16 15:10 UTC (permalink / raw)
  To: Alban Crequy
  Cc: iago, dongsu, linux-kernel, linux-integrity,
	linux-security-module, linux-fsdevel, Miklos Szeredi,
	Alexander Viro, Mimi Zohar, Dmitry Kasatkin, James Morris,
	Serge E. Hallyn, Seth Forshee, Christoph Hellwig

From: Alban Crequy <alban@kinvolk.io>

This patch forces files to be re-measured, re-appraised and re-audited
on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
cached integrity results won't be used.

For now, this patch adds the new flag only FUSE filesystems. This is
needed because the userspace FUSE process can change the underlying
files at any time.

How to test this:

====

The test I did was using a patched version of the memfs FUSE driver
[2][3] and two very simple "hello-world" programs [5] (prog1 prints
"hello world: 1" and prog2 prints "hello world: 2").

I copy prog1 and prog2 in the fuse-memfs mount point, execute them and
check the sha1 hash in
"/sys/kernel/security/ima/ascii_runtime_measurements".

My patch on the memfs FUSE driver added a backdoor command to serve
prog1 when the kernel asks for prog2 or vice-versa. In this way, I can
exec prog1 and get it to print "hello world: 2" without ever replacing
the file via the VFS, so the kernel is not aware of the change.

The test was done using the branch "alban/fuse-flag-ima-nocache-v2" [4].

Step by step test procedure:

1. Mount the memfs FUSE using [3]:
rm -f  /tmp/memfs-switch* ; memfs -L DEBUG  /mnt/memfs

2. Copy prog1 and prog2 using [5]
cp prog1 /mnt/memfs/prog1
cp prog2 /mnt/memfs/prog2

3. Lookup the files and let the FUSE driver to keep the handles open:
dd if=/mnt/memfs/prog1 bs=1 | (read -n 1 x ; sleep 3600 ) &
dd if=/mnt/memfs/prog2 bs=1 | (read -n 1 x ; sleep 3600 ) &

4. Check the 2 programs work correctly:
$ /mnt/memfs/prog1
hello world: 1
$ /mnt/memfs/prog2
hello world: 2

5. Check the measurements for prog1 and prog2:
$ sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \
                | grep /mnt/memfs/prog
10 [...] ima-ng sha1:ac14c9268cd2[...] /mnt/memfs/prog1
10 [...] ima-ng sha1:799cb5d1e06d[...] /mnt/memfs/prog2

6. Use the backdoor command in my patched memfs to redirect file
operations on file handle 3 to file handle 2:
rm -f  /tmp/memfs-switch* ; touch /tmp/memfs-switch-3-2

7. Check how the FUSE driver serves different content for the files:
$ /mnt/memfs/prog1
hello world: 2
$ /mnt/memfs/prog2
hello world: 2

8. Check the measurements:
sudo cat /sys/kernel/security/ima/ascii_runtime_measurements \
                | grep /mnt/memfs/prog

Without the patch, there are no new measurements, despite the FUSE
driver having served different executables.

With the patch, I can see additional measurements for prog1 and prog2
with the hashes reversed when the FUSE driver served the alternative
content.

====

[1] https://www.spinics.net/lists/linux-integrity/msg00948.html
[2] https://github.com/bbengfort/memfs
[3] https://github.com/kinvolk/memfs/commits/alban/switch-files
[4] https://github.com/kinvolk/linux/commits/alban/fuse-flag-ima-nocache-v2
[5] https://github.com/kinvolk/fuse-userns-patches/commit/cf1f5750cab0

Cc: linux-kernel@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Christoph Hellwig <hch@infradead.org>
Tested-by: Dongsu Park <dongsu@kinvolk.io>
Signed-off-by: Alban Crequy <alban@kinvolk.io>

---

There was a previous attempt (unmerged) with a IMA option named "force" and using
that option for FUSE filesystems. This patch uses a different approach
so that the IMA subsystem does not need to know about FUSE.
- https://www.spinics.net/lists/linux-integrity/msg00948.html
- https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1584131.html

Changes since v1: https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1587390.html
- include linux-fsdevel mailing list in cc
- mark patch as RFC
- based on next-integrity, without other unmerged FUSE / IMA patches
---
 fs/fuse/inode.c                   |  2 +-
 include/linux/fs.h                |  1 +
 security/integrity/ima/ima_main.c | 24 ++++++++++++++++++++++--
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 624f18bbfd2b..5bf14289afba 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1205,7 +1205,7 @@ static void fuse_kill_sb_anon(struct super_block *sb)
 static struct file_system_type fuse_fs_type = {
 	.owner		= THIS_MODULE,
 	.name		= "fuse",
-	.fs_flags	= FS_HAS_SUBTYPE,
+	.fs_flags	= FS_HAS_SUBTYPE | FS_NO_IMA_CACHE,
 	.mount		= fuse_mount,
 	.kill_sb	= fuse_kill_sb_anon,
 };
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 511fbaabf624..2bd7e73ebc2a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2075,6 +2075,7 @@ struct file_system_type {
 #define FS_BINARY_MOUNTDATA	2
 #define FS_HAS_SUBTYPE		4
 #define FS_USERNS_MOUNT		8	/* Can be mounted by userns root */
+#define FS_NO_IMA_CACHE		16	/* Force IMA to re-measure, re-appraise, re-audit files */
 #define FS_RENAME_DOES_D_MOVE	32768	/* FS will handle d_move() during rename() internally. */
 	struct dentry *(*mount) (struct file_system_type *, int,
 		       const char *, void *);
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 6d78cb26784d..2ce4d69068a8 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/ima.h>
+#include <linux/fs.h>
 
 #include "ima.h"
 
@@ -228,9 +229,28 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
 				 IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
 				 IMA_ACTION_FLAGS);
 
-	if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags))
-		/* reset all flags if ima_inode_setxattr was called */
+	/*
+	 * Reset the measure, appraise and audit cached flags either if:
+	 * - ima_inode_setxattr was called, or
+	 * - based on filesystem feature flag
+	 * forcing the file to be re-evaluated.
+	 */
+	if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) {
 		iint->flags &= ~IMA_DONE_MASK;
+	} else if (inode->i_sb->s_type->fs_flags & FS_NO_IMA_CACHE) {
+		if (action & IMA_MEASURE) {
+			iint->measured_pcrs = 0;
+			iint->flags &=
+			    ~(IMA_COLLECTED | IMA_MEASURE | IMA_MEASURED);
+		}
+		if (action & IMA_APPRAISE)
+			iint->flags &=
+			    ~(IMA_COLLECTED | IMA_APPRAISE | IMA_APPRAISED |
+			      IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK);
+		if (action & IMA_AUDIT)
+			iint->flags &=
+			    ~(IMA_COLLECTED | IMA_AUDIT | IMA_AUDITED);
+	}
 
 	/* Determine if already appraised/measured based on bitmask
 	 * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
-- 
2.13.6

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
  2018-01-16 15:10 [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE Alban Crequy
@ 2018-01-18 21:25 ` Mimi Zohar
  2018-01-19 10:35   ` Alban Crequy
  0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2018-01-18 21:25 UTC (permalink / raw)
  To: Alban Crequy, Alban Crequy
  Cc: iago, dongsu, linux-kernel, linux-integrity,
	linux-security-module, linux-fsdevel, Miklos Szeredi,
	Alexander Viro, Dmitry Kasatkin, James Morris, Serge E. Hallyn,
	Seth Forshee, Christoph Hellwig

On Tue, 2018-01-16 at 16:10 +0100, Alban Crequy wrote:
> From: Alban Crequy <alban@kinvolk.io>
> 
> This patch forces files to be re-measured, re-appraised and re-audited
> on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
> cached integrity results won't be used.
> 
> For now, this patch adds the new flag only FUSE filesystems. This is
> needed because the userspace FUSE process can change the underlying
> files at any time.

Thanks, it's working nicely. 


> diff --git a/include/linux/fs.h b/include/linux/fs.h
> index 511fbaabf624..2bd7e73ebc2a 100644
> --- a/include/linux/fs.h
> +++ b/include/linux/fs.h
> @@ -2075,6 +2075,7 @@ struct file_system_type {
>  #define FS_BINARY_MOUNTDATA	2
>  #define FS_HAS_SUBTYPE		4
>  #define FS_USERNS_MOUNT		8	/* Can be mounted by userns root */
> +#define FS_NO_IMA_CACHE		16	/* Force IMA to re-measure, re-appraise, re-audit files */
>  #define FS_RENAME_DOES_D_MOVE	32768	/* FS will handle d_move() during rename() internally. */
>  	struct dentry *(*mount) (struct file_system_type *, int,
>  		       const char *, void *);
> 

Since IMA is going to need another flag, we probably should have a
consistent prefix (eg. "FS_IMA").  Maybe rename this flag to
FS_IMA_NO_CACHE.  I'm also wondering if this change should be
separated from the IMA change.

Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
  2018-01-18 21:25 ` Mimi Zohar
@ 2018-01-19 10:35   ` Alban Crequy
  2018-01-19 16:56     ` Mimi Zohar
  0 siblings, 1 reply; 6+ messages in thread
From: Alban Crequy @ 2018-01-19 10:35 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: Alban Crequy, Iago López Galeiras, Dongsu Park, LKML,
	linux-integrity, linux-security-module, linux-fsdevel,
	Miklos Szeredi, Alexander Viro, Dmitry Kasatkin, James Morris,
	Serge E. Hallyn, Seth Forshee, Christoph Hellwig

On Thu, Jan 18, 2018 at 10:25 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> On Tue, 2018-01-16 at 16:10 +0100, Alban Crequy wrote:
>> From: Alban Crequy <alban@kinvolk.io>
>>
>> This patch forces files to be re-measured, re-appraised and re-audited
>> on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
>> cached integrity results won't be used.
>>
>> For now, this patch adds the new flag only FUSE filesystems. This is
>> needed because the userspace FUSE process can change the underlying
>> files at any time.
>
> Thanks, it's working nicely.
>
>
>> diff --git a/include/linux/fs.h b/include/linux/fs.h
>> index 511fbaabf624..2bd7e73ebc2a 100644
>> --- a/include/linux/fs.h
>> +++ b/include/linux/fs.h
>> @@ -2075,6 +2075,7 @@ struct file_system_type {
>>  #define FS_BINARY_MOUNTDATA  2
>>  #define FS_HAS_SUBTYPE               4
>>  #define FS_USERNS_MOUNT              8       /* Can be mounted by userns root */
>> +#define FS_NO_IMA_CACHE              16      /* Force IMA to re-measure, re-appraise, re-audit files */
>>  #define FS_RENAME_DOES_D_MOVE        32768   /* FS will handle d_move() during rename() internally. */
>>       struct dentry *(*mount) (struct file_system_type *, int,
>>                      const char *, void *);
>>
>
> Since IMA is going to need another flag, we probably should have a
> consistent prefix (eg. "FS_IMA").  Maybe rename this flag to
> FS_IMA_NO_CACHE.

Ok, I can rename it.

Is there a discussion about the other IMA flag?

> I'm also wondering if this change should be
> separated from the IMA change.

Do you mean one patch for adding the flag and the IMA change and
another patch for using the flag in FUSE?

Thanks!
Alban

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
  2018-01-19 10:35   ` Alban Crequy
@ 2018-01-19 16:56     ` Mimi Zohar
  2018-01-22  9:16       ` Alban Crequy
  0 siblings, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2018-01-19 16:56 UTC (permalink / raw)
  To: Alban Crequy
  Cc: Alban Crequy, Iago López Galeiras, Dongsu Park, LKML,
	linux-integrity, linux-security-module, linux-fsdevel,
	Miklos Szeredi, Alexander Viro, Dmitry Kasatkin, James Morris,
	Serge E. Hallyn, Seth Forshee, Christoph Hellwig

On Fri, 2018-01-19 at 11:35 +0100, Alban Crequy wrote:
> On Thu, Jan 18, 2018 at 10:25 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > On Tue, 2018-01-16 at 16:10 +0100, Alban Crequy wrote:
> >> From: Alban Crequy <alban@kinvolk.io>
> >>
> >> This patch forces files to be re-measured, re-appraised and re-audited
> >> on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
> >> cached integrity results won't be used.
> >>
> >> For now, this patch adds the new flag only FUSE filesystems. This is
> >> needed because the userspace FUSE process can change the underlying
> >> files at any time.
> >
> > Thanks, it's working nicely.
> >
> >
> >> diff --git a/include/linux/fs.h b/include/linux/fs.h
> >> index 511fbaabf624..2bd7e73ebc2a 100644
> >> --- a/include/linux/fs.h
> >> +++ b/include/linux/fs.h
> >> @@ -2075,6 +2075,7 @@ struct file_system_type {
> >>  #define FS_BINARY_MOUNTDATA  2
> >>  #define FS_HAS_SUBTYPE               4
> >>  #define FS_USERNS_MOUNT              8       /* Can be mounted by userns root */
> >> +#define FS_NO_IMA_CACHE              16      /* Force IMA to re-measure, re-appraise, re-audit files */
> >>  #define FS_RENAME_DOES_D_MOVE        32768   /* FS will handle d_move() during rename() internally. */
> >>       struct dentry *(*mount) (struct file_system_type *, int,
> >>                      const char *, void *);
> >>
> >
> > Since IMA is going to need another flag, we probably should have a
> > consistent prefix (eg. "FS_IMA").  Maybe rename this flag to
> > FS_IMA_NO_CACHE.
> 
> Ok, I can rename it.
> 
> Is there a discussion about the other IMA flag?

There's not a single thread that I can point to, but more of an on
going discussion as to what it means for a filesystem to support IMA
and how that decision is made.

- Initial measuring, verifying, auditing files
- Safely detecting when a file changes
- Not applicable/supported

With Sascha Hauer's patch "ima: Use i_version only when filesystem
supports it" and this patch, the second issue is addressed, but will
cause files to be re-validated, perhaps unnecessarily, impacting
performance.

Some filesystems should not be evaluated, such as pseudo filesystems
(eg. cgroups, sysfs, devpts, pstorefs, efivarfs, debugfs, selinux,
smack).  Instead of defining a flag indicating whether or not IMA is
applicable/supported, we should define a new flag, indicating whether
it is a pseudo filesystem.  This would eliminate a large portion of at
least the builtin IMA policy rules.

> > I'm also wondering if this change should be
> > separated from the IMA change.
> 
> Do you mean one patch for adding the flag and the IMA change and
> another patch for using the flag in FUSE?

The flag and FUSE usage of the flag, separately from IMA.

Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
  2018-01-19 16:56     ` Mimi Zohar
@ 2018-01-22  9:16       ` Alban Crequy
  2018-01-22 12:56         ` Mimi Zohar
  0 siblings, 1 reply; 6+ messages in thread
From: Alban Crequy @ 2018-01-22  9:16 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: Alban Crequy, Iago López Galeiras, Dongsu Park, LKML,
	linux-integrity, linux-security-module, linux-fsdevel,
	Miklos Szeredi, Alexander Viro, Dmitry Kasatkin, James Morris,
	Serge E. Hallyn, Seth Forshee, Christoph Hellwig

On Fri, Jan 19, 2018 at 5:56 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> On Fri, 2018-01-19 at 11:35 +0100, Alban Crequy wrote:
>> On Thu, Jan 18, 2018 at 10:25 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>> > On Tue, 2018-01-16 at 16:10 +0100, Alban Crequy wrote:
>> >> From: Alban Crequy <alban@kinvolk.io>
>> >>
>> >> This patch forces files to be re-measured, re-appraised and re-audited
>> >> on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
>> >> cached integrity results won't be used.
>> >>
>> >> For now, this patch adds the new flag only FUSE filesystems. This is
>> >> needed because the userspace FUSE process can change the underlying
>> >> files at any time.
>> >
>> > Thanks, it's working nicely.
>> >
>> >
>> >> diff --git a/include/linux/fs.h b/include/linux/fs.h
>> >> index 511fbaabf624..2bd7e73ebc2a 100644
>> >> --- a/include/linux/fs.h
>> >> +++ b/include/linux/fs.h
>> >> @@ -2075,6 +2075,7 @@ struct file_system_type {
>> >>  #define FS_BINARY_MOUNTDATA  2
>> >>  #define FS_HAS_SUBTYPE               4
>> >>  #define FS_USERNS_MOUNT              8       /* Can be mounted by userns root */
>> >> +#define FS_NO_IMA_CACHE              16      /* Force IMA to re-measure, re-appraise, re-audit files */
>> >>  #define FS_RENAME_DOES_D_MOVE        32768   /* FS will handle d_move() during rename() internally. */
>> >>       struct dentry *(*mount) (struct file_system_type *, int,
>> >>                      const char *, void *);
>> >>
>> >
>> > Since IMA is going to need another flag, we probably should have a
>> > consistent prefix (eg. "FS_IMA").  Maybe rename this flag to
>> > FS_IMA_NO_CACHE.
>>
>> Ok, I can rename it.
>>
>> Is there a discussion about the other IMA flag?
>
> There's not a single thread that I can point to, but more of an on
> going discussion as to what it means for a filesystem to support IMA
> and how that decision is made.
>
> - Initial measuring, verifying, auditing files
> - Safely detecting when a file changes
> - Not applicable/supported
>
> With Sascha Hauer's patch "ima: Use i_version only when filesystem
> supports it" and this patch, the second issue is addressed, but will
> cause files to be re-validated, perhaps unnecessarily, impacting
> performance.
>
> Some filesystems should not be evaluated, such as pseudo filesystems
> (eg. cgroups, sysfs, devpts, pstorefs, efivarfs, debugfs, selinux,
> smack).  Instead of defining a flag indicating whether or not IMA is
> applicable/supported, we should define a new flag, indicating whether
> it is a pseudo filesystem.  This would eliminate a large portion of at
> least the builtin IMA policy rules.

Thanks for the explanation. If that other flag is about whether it is
a pseudo filesystem, it might not have "IMA" in the name though.

>> > I'm also wondering if this change should be
>> > separated from the IMA change.
>>
>> Do you mean one patch for adding the flag and the IMA change and
>> another patch for using the flag in FUSE?
>
> The flag and FUSE usage of the flag, separately from IMA.

Ok, I will send a v3 with the 2 changes.

Alban

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE
  2018-01-22  9:16       ` Alban Crequy
@ 2018-01-22 12:56         ` Mimi Zohar
  0 siblings, 0 replies; 6+ messages in thread
From: Mimi Zohar @ 2018-01-22 12:56 UTC (permalink / raw)
  To: Alban Crequy
  Cc: Alban Crequy, Iago López Galeiras, Dongsu Park, LKML,
	linux-integrity, linux-security-module, linux-fsdevel,
	Miklos Szeredi, Alexander Viro, Dmitry Kasatkin, James Morris,
	Serge E. Hallyn, Seth Forshee, Christoph Hellwig

On Mon, 2018-01-22 at 10:16 +0100, Alban Crequy wrote:
> On Fri, Jan 19, 2018 at 5:56 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > On Fri, 2018-01-19 at 11:35 +0100, Alban Crequy wrote:
> >> On Thu, Jan 18, 2018 at 10:25 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> >> > On Tue, 2018-01-16 at 16:10 +0100, Alban Crequy wrote:
> >> >> From: Alban Crequy <alban@kinvolk.io>
> >> >>
> >> >> This patch forces files to be re-measured, re-appraised and re-audited
> >> >> on file systems with the feature flag FS_NO_IMA_CACHE. In that way,
> >> >> cached integrity results won't be used.
> >> >>
> >> >> For now, this patch adds the new flag only FUSE filesystems. This is
> >> >> needed because the userspace FUSE process can change the underlying
> >> >> files at any time.
> >> >
> >> > Thanks, it's working nicely.
> >> >
> >> >
> >> >> diff --git a/include/linux/fs.h b/include/linux/fs.h
> >> >> index 511fbaabf624..2bd7e73ebc2a 100644
> >> >> --- a/include/linux/fs.h
> >> >> +++ b/include/linux/fs.h
> >> >> @@ -2075,6 +2075,7 @@ struct file_system_type {
> >> >>  #define FS_BINARY_MOUNTDATA  2
> >> >>  #define FS_HAS_SUBTYPE               4
> >> >>  #define FS_USERNS_MOUNT              8       /* Can be mounted by userns root */
> >> >> +#define FS_NO_IMA_CACHE              16      /* Force IMA to re-measure, re-appraise, re-audit files */
> >> >>  #define FS_RENAME_DOES_D_MOVE        32768   /* FS will handle d_move() during rename() internally. */
> >> >>       struct dentry *(*mount) (struct file_system_type *, int,
> >> >>                      const char *, void *);
> >> >>
> >> >
> >> > Since IMA is going to need another flag, we probably should have a
> >> > consistent prefix (eg. "FS_IMA").  Maybe rename this flag to
> >> > FS_IMA_NO_CACHE.
> >>
> >> Ok, I can rename it.
> >>
> >> Is there a discussion about the other IMA flag?
> >
> > There's not a single thread that I can point to, but more of an on
> > going discussion as to what it means for a filesystem to support IMA
> > and how that decision is made.
> >
> > - Initial measuring, verifying, auditing files
> > - Safely detecting when a file changes
> > - Not applicable/supported
> >
> > With Sascha Hauer's patch "ima: Use i_version only when filesystem
> > supports it" and this patch, the second issue is addressed, but will
> > cause files to be re-validated, perhaps unnecessarily, impacting
> > performance.
> >
> > Some filesystems should not be evaluated, such as pseudo filesystems
> > (eg. cgroups, sysfs, devpts, pstorefs, efivarfs, debugfs, selinux,
> > smack).  Instead of defining a flag indicating whether or not IMA is
> > applicable/supported, we should define a new flag, indicating whether
> > it is a pseudo filesystem.  This would eliminate a large portion of at
> > least the builtin IMA policy rules.
> 
> Thanks for the explanation. If that other flag is about whether it is
> a pseudo filesystem, it might not have "IMA" in the name though.

Agreed.  If we ever need to define another FS flag, we would most
likely define it in the negative (eg. FS_NO_IMA_XXXXX).  So the
current name is fine.

> >> > I'm also wondering if this change should be
> >> > separated from the IMA change.
> >>
> >> Do you mean one patch for adding the flag and the IMA change and
> >> another patch for using the flag in FUSE?
> >
> > The flag and FUSE usage of the flag, separately from IMA.
> 
> Ok, I will send a v3 with the 2 changes.

thanks,

Mimi

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2018-01-22 12:56 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-16 15:10 [RFC PATCH v2] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE Alban Crequy
2018-01-18 21:25 ` Mimi Zohar
2018-01-19 10:35   ` Alban Crequy
2018-01-19 16:56     ` Mimi Zohar
2018-01-22  9:16       ` Alban Crequy
2018-01-22 12:56         ` Mimi Zohar

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).