From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linus Torvalds Subject: Re: [PATCH v1.2 0/5] IMA: making i_readcount a first class inode citizen (reposting) Date: Sun, 21 Nov 2010 09:56:17 -0800 Message-ID: References: <1290121382-4039-1-git-send-email-zohar@linux.vnet.ibm.com> <20101119175053.GC29148@fieldses.org> <1290345498.2412.38.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Cc: "J. Bruce Fields" , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, jmorris@namei.org, akpm@linux-foundation.org, eparis@redhat.com, viro@zeniv.linux.org.uk, Dave Chinner , David Safford To: Mimi Zohar Return-path: In-Reply-To: <1290345498.2412.38.camel@localhost.localdomain> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Sun, Nov 21, 2010 at 5:18 AM, Mimi Zohar wrote: > > IMA (and the proposed EVM/IMA-appraisal patches) detects file change > based on i_version. When the file is closed, if the file has changed, > IMA marks the file as needing to be re-measured. Of course this requires > the filesystem to be mounted with iversion. Don't know if this helps. If you only do this at close time, I see a _major_ security hole. The attacker can just write to the file, and keep it open. Ta-daa, everybody who reads it sees the new contents, but your IMA logic is oblivious and thinks it doesn't need to be re-measured. Linus