From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: Re: [PATCH v2 10/18] evm: Turn evm_update_evmxattr into void function Date: Wed, 25 May 2016 07:08:10 -0400 Message-ID: <1464174490.2763.146.camel@linux.vnet.ibm.com> References: <1463742875-9836-1-git-send-email-agruenba@redhat.com> <1463742875-9836-11-git-send-email-agruenba@redhat.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: linux-unionfs-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: James Morris Cc: Andreas Gruenbacher , Alexander Viro , linux-fsdevel@vger.kernel.org, Tyler Hicks , ecryptfs@vger.kernel.org, Miklos Szeredi , linux-unionfs@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, David Howells , Serge Hallyn , Dmitry Kasatkin , Paul Moore , Stephen Smalley , Eric Paris , Casey Schaufler , Oleg Drokin , Andreas Dilger On Wed, 2016-05-25 at 15:30 +1000, James Morris wrote: > On Fri, 20 May 2016, Andreas Gruenbacher wrote: > > > The return value of evm_update_evmxattr is never used. > > > > Signed-off-by: Andreas Gruenbacher > > As I mentioned last time, the EVM code is silently ignoring errors here, > and I'd prefer to see that fixed. Agreed. evm_update_evmxattr() is called as a result of a "protected" xattr or some other file metadata having been modified. The two actions need to remain in sync, otherwise subsequent file access will be denied. At the point that evm_update_evmxattr() fails, there isn't much that can be done other than audit the failure. The file metadata has already been modified. Mimi