diff for duplicates of <1520548086.3605.135.camel@linux.vnet.ibm.com> diff --git a/a/1.txt b/N1/1.txt index f7a9f9c..af1f559 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -29,7 +29,7 @@ On Thu, 2018-03-08 at 15:15 -0700, Tycho Andersen wrote: > > > > > rc = 0; > > > > > > > > Only when IMA-appraisal is enforcing file data integrity should -> > > > process_measurement() ever fail. Other errors can be logged/audited. +> > > > process_measurement() ever fail. Other errors can be logged/audited. > > > > > > Ok, so previously in ima_audit_measurement() when allocation failed, > > > there was nothing logged. If we just keep this behavior like below, @@ -37,13 +37,13 @@ On Thu, 2018-03-08 at 15:15 -0700, Tycho Andersen wrote: > > > > Before the IMA locking change that were just upstreamed, there were > > problems with measuring/appraising files that were opened with the -> > O_DIRECT flag. Unless the IMA policy specified permit_directio, the -> > measurement/appraisal failed. With the new locking, opening files -> > with the O_DIRECTIO flag shouldn't be a problem. It just needs to be +> > O_DIRECT flag. Unless the IMA policy specified permit_directio, the +> > measurement/appraisal failed. With the new locking, opening files +> > with the O_DIRECTIO flag shouldn't be a problem. It just needs to be > > fully tested before removing this code. > > > > On failure, the code below tests the ima_audit_measurement() result -> > and skips the IMA_PERMIT_DIRECTIO test. Unless I'm missing something, +> > and skips the IMA_PERMIT_DIRECTIO test. Unless I'm missing something, > > I don't see the point. > > It skips the IMA_PERMIT_DIRECTIO test because it's already going to @@ -53,8 +53,8 @@ On Thu, 2018-03-08 at 15:15 -0700, Tycho Andersen wrote: > maybe ignoring failures is ok; seems like it's not, though By the time we get here, we've already verified the file's integrity, -if it is in policy. At this point, we're attempting to add the file -hash to the audit log. If for some reason the audit fails, there's +if it is in policy. At this point, we're attempting to add the file +hash to the audit log. If for some reason the audit fails, there's not much we can do. > I'm not sure I really understand the rest of your message though. Can diff --git a/a/content_digest b/N1/content_digest index f66c39a..65419df 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -44,7 +44,7 @@ "> > > > > \t\trc = 0;\n" "> > > > \n" "> > > > Only when IMA-appraisal is enforcing file data integrity should\n" - "> > > > process_measurement() ever fail. \302\240Other errors can be logged/audited.\n" + "> > > > process_measurement() ever fail. Other errors can be logged/audited.\n" "> > > \n" "> > > Ok, so previously in ima_audit_measurement() when allocation failed,\n" "> > > there was nothing logged. If we just keep this behavior like below,\n" @@ -52,13 +52,13 @@ "> > \n" "> > Before the IMA locking change that were just upstreamed, there were\n" "> > problems with measuring/appraising files that were opened with the\n" - "> > O_DIRECT flag. \302\240Unless the IMA policy specified permit_directio, the\n" - "> > measurement/appraisal failed. \302\240With the new locking, opening files\n" - "> > with the O_DIRECTIO flag shouldn't be a problem. \302\240It just needs to be\n" + "> > O_DIRECT flag. Unless the IMA policy specified permit_directio, the\n" + "> > measurement/appraisal failed. With the new locking, opening files\n" + "> > with the O_DIRECTIO flag shouldn't be a problem. It just needs to be\n" "> > fully tested before removing this code.\n" "> > \n" "> > On failure, the code below tests the ima_audit_measurement() result\n" - "> > and skips the IMA_PERMIT_DIRECTIO test. \302\240Unless I'm missing something,\n" + "> > and skips the IMA_PERMIT_DIRECTIO test. Unless I'm missing something,\n" "> > I don't see the point.\n" "> \n" "> It skips the IMA_PERMIT_DIRECTIO test because it's already going to\n" @@ -68,8 +68,8 @@ "> maybe ignoring failures is ok; seems like it's not, though\n" "\n" "By the time we get here, we've already verified the file's integrity,\n" - "if it is in policy. \302\240At this point, we're attempting to add the file\n" - "hash to the audit log. \302\240If for some reason the audit fails, there's\n" + "if it is in policy. At this point, we're attempting to add the file\n" + "hash to the audit log. If for some reason the audit fails, there's\n" "not much we can do.\n" "\n" "> I'm not sure I really understand the rest of your message though. Can\n" @@ -80,4 +80,4 @@ "\n" Mimi -bb3d1061a6a674ea033b5d9297bacdef03c8270a1aff18c33b9df07a9faf86ff +6d6a627170a39745ccd8fd32eb1d3440ed87f9c2fd63ceaf72f2ddce1e764968
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.