Re: [PATCH 2/3] IMA: Make use of filesystem-provided hashes

[Mimi Zohar <zohar@linux.ibm.com>]

On Thu, 2018-10-11 at 13:30 -0700, Matthew Garrett wrote:
> On Thu, Oct 11, 2018 at 8:23 AM Mimi Zohar <zohar@linux.ibm.com> wrote:
> >
> > On Thu, 2018-10-04 at 13:30 -0700, Matthew Garrett wrote:
> > > Some filesystems may be able to provide hashes in an out of band manner,
> > > and allowing them to do so is a performance win. This is especially true
> > > of FUSE-based filesystems where otherwise we recalculate the hash on
> > > every measurement. Make use of this by default, but provide a parameter
> > > to force recalculation rather than trusting the filesystem.
> > >
> > > Signed-off-by: Matthew Garrett <mjg59@google.com>
> >
> > Support for not calculating the file hash would need to be finer
> > grained than this, probably on a per mount basis.  The default should
> > be for IMA to always calculate the file hash, unless explicitly told
> > not to.
> 
> Ok, should this just be part of the IMA policy?

How would you be able to differentiate between different FUSE
filesystems for example?

> 
> > IMA should never skip the file hash calculation if the filesystem is
> > an untrusted mount (eg. SB_I_UNTRUSTED_MOUNTER).
> 
> Ok.
>