From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:40619 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751659AbdGEOuY (ORCPT ); Wed, 5 Jul 2017 10:50:24 -0400 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v65EiFe3102504 for ; Wed, 5 Jul 2017 10:50:23 -0400 Received: from e23smtp08.au.ibm.com (e23smtp08.au.ibm.com [202.81.31.141]) by mx0b-001b2d01.pphosted.com with ESMTP id 2bh0tev5e4-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 05 Jul 2017 10:50:23 -0400 Received: from localhost by e23smtp08.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 6 Jul 2017 00:50:20 +1000 Subject: Re: [PATCH v2 10/10] ima: use existing read file operation method to calculate file hash From: Mimi Zohar To: Christoph Hellwig Cc: Al Viro , James Morris , linux-fsdevel@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-ima-user Date: Wed, 05 Jul 2017 10:50:09 -0400 In-Reply-To: <20170628144111.GI2359@lst.de> References: <1498069110-10009-1-git-send-email-zohar@linux.vnet.ibm.com> <1498069110-10009-11-git-send-email-zohar@linux.vnet.ibm.com> <20170628144111.GI2359@lst.de> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <1499266209.3059.91.camel@linux.vnet.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: [Cc'ing linux-ima-users] On Wed, 2017-06-28 at 16:41 +0200, Christoph Hellwig wrote: > NAK - we'll need an explicit method for the integrity code. > > And just curious - what filesystem that you care about actually > implements ->read instead of ->read_iter? We shouldn't be doing that > for real file systems anymore. Right, pseudo filesystems are using ->read. The existing builtin measurement policies exclude a number of pseudo filesystems, but not efivarfs.  Unfortunately, we do not know what type of custom policies are currently being used. The contents of the IMA measurement list are verified against a reference manifest, provided at registration, or against a white list. Not measuring files that were previously measured could break userspace applications. Let's wait to hear back from the larger IMA community as to whether there is a need to measure files on pseudo filesystems, before implementing an explicit method. Mimi