From: Petr Vorel <pvorel@suse.cz>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: Jia Zhang <zhang.jia@linux.alibaba.com>,
zohar@linux.vnet.ibm.com, linux-integrity@vger.kernel.org,
ltp@lists.linux.it
Subject: Re: [PATCH 6/6] ima: Use ima tcb policy files for test
Date: Tue, 15 Jan 2019 11:50:05 +0100 [thread overview]
Message-ID: <20190115105005.GA12143@dell5510> (raw)
In-Reply-To: <1547494342.4156.188.camel@linux.ibm.com>
Hi Mimi, Jia,
> On Mon, 2019-01-07 at 10:26 +0800, Jia Zhang wrote:
> > In order to make all tests running smoothly, the policy files should
> > keep up with the default ima tcb policy.
> Keeping the policy rules in sync is a good idea, but some of the rules
> might cause a regression with older kernels (eg. NSFS magic). Not
> including the rule, also poses a problem.
Mimi, you added NSFS_MAGIC into policy in v4.2 (cd025f7f9410 "ima: do not
measure or appraise the NSFS filesystem"), in the commit is Cc for 3.19, but
it's not in origin/linux-3.19.y stable tree (v3.19.8). So regression could be
from kernel <= 4.1.
> The kernel headers package includes magic.h. One solution would be to check whether a magic name is included in magic.h.
Interesting approach, I like this approach. Policy would have to be generated on
the fly, but that shouldn't be a problem.
Kind regards,
Petr
WARNING: multiple messages have this Message-ID (diff)
From: Petr Vorel <pvorel@suse.cz>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH 6/6] ima: Use ima tcb policy files for test
Date: Tue, 15 Jan 2019 11:50:05 +0100 [thread overview]
Message-ID: <20190115105005.GA12143@dell5510> (raw)
In-Reply-To: <1547494342.4156.188.camel@linux.ibm.com>
Hi Mimi, Jia,
> On Mon, 2019-01-07 at 10:26 +0800, Jia Zhang wrote:
> > In order to make all tests running smoothly, the policy files should
> > keep up with the default ima tcb policy.
> Keeping the policy rules in sync is a good idea, but some of the rules
> might cause a regression with older kernels (eg. NSFS magic). Not
> including the rule, also poses a problem.
Mimi, you added NSFS_MAGIC into policy in v4.2 (cd025f7f9410 "ima: do not
measure or appraise the NSFS filesystem"), in the commit is Cc for 3.19, but
it's not in origin/linux-3.19.y stable tree (v3.19.8). So regression could be
from kernel <= 4.1.
> The kernel headers package includes magic.h. One solution would be to check whether a magic name is included in magic.h.
Interesting approach, I like this approach. Policy would have to be generated on
the fly, but that shouldn't be a problem.
Kind regards,
Petr
next prev parent reply other threads:[~2019-01-15 10:50 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-07 2:26 [PATCH 0/6] LTP IMA fix bundle Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-07 2:26 ` [PATCH 1/6] ima/ima_boot_aggregate: Fix the definition of event log Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-07 2:26 ` [PATCH 2/6] ima/ima_boot_aggregate: Don't hard code the length of sha1 hash Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-14 20:33 ` Mimi Zohar
2019-01-14 20:33 ` [LTP] " Mimi Zohar
2019-01-07 2:26 ` [PATCH 3/6] ima/ima_boot_aggregate: Fix extending PCRs beyond PCR 0-7 Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-14 20:32 ` Mimi Zohar
2019-01-14 20:32 ` [LTP] " Mimi Zohar
2019-01-07 2:26 ` [PATCH 4/6] ima: Code cleanup Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-14 21:09 ` Mimi Zohar
2019-01-14 21:09 ` [LTP] " Mimi Zohar
2019-01-07 2:26 ` [PATCH 5/6] ima: Rename the folder name for policy files to datafiles Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-07 2:26 ` [PATCH 6/6] ima: Use ima tcb policy files for test Jia Zhang
2019-01-07 2:26 ` [LTP] " Jia Zhang
2019-01-07 15:59 ` Jia Zhang
2019-01-07 15:59 ` [LTP] " Jia Zhang
2019-01-14 19:32 ` Mimi Zohar
2019-01-14 19:32 ` [LTP] " Mimi Zohar
2019-01-15 1:12 ` Jia Zhang
2019-01-15 1:12 ` [LTP] " Jia Zhang
2019-01-15 10:50 ` Petr Vorel [this message]
2019-01-15 10:50 ` Petr Vorel
2019-01-13 12:14 ` [PATCH 0/6] LTP IMA fix bundle Jia Zhang
2019-01-13 12:14 ` [LTP] " Jia Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190115105005.GA12143@dell5510 \
--to=pvorel@suse.cz \
--cc=linux-integrity@vger.kernel.org \
--cc=ltp@lists.linux.it \
--cc=zhang.jia@linux.alibaba.com \
--cc=zohar@linux.ibm.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.