From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:46622 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751449AbeAPLfo (ORCPT ); Tue, 16 Jan 2018 06:35:44 -0500 Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w0GBYmZ5009069 for ; Tue, 16 Jan 2018 06:35:44 -0500 Received: from e06smtp12.uk.ibm.com (e06smtp12.uk.ibm.com [195.75.94.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 2fhgjgr8xh-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 16 Jan 2018 06:35:43 -0500 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 16 Jan 2018 11:35:41 -0000 Subject: Re: [PATCH] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE From: Mimi Zohar To: Alban Crequy , Alban Crequy Cc: Iago =?ISO-8859-1?Q?L=F3pez?= Galeiras , Dongsu Park , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Miklos Szeredi , Seth Forshee , Christoph Hellwig Date: Tue, 16 Jan 2018 06:35:34 -0500 In-Reply-To: References: <20180115144804.GA28856@infradead.org> <20180116104121.4231-1-alban@kinvolk.io> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Message-Id: <1516102534.6607.103.camel@linux.vnet.ibm.com> Sender: linux-integrity-owner@vger.kernel.org List-ID: > > > > /* > > - * Reset the measure, appraise and audit cached flags either if > > - * ima_inode_setxattr was called or based on policy, forcing > > - * the file to be re-evaluated. > > + * Reset the measure, appraise and audit cached flags either if: > > + * - ima_inode_setxattr was called, or > > + * - based on policy ("force"), or > > + * - based on filesystem feature flag > > + * forcing the file to be re-evaluated. > > */ > > Now that I think about it, it's also possible to write this patch > without basing it on Mimi's patch "ima: define a new policy option > named force", which is not in next-integrity yet. Should I try that? Yes, thank you. As you're proposing a new flag, please remember to Cc the fsdevel mailing list as well. Mimi > > > if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags)) { > > iint->flags &= ~IMA_DONE_MASK; > > - } else if (action & IMA_FORCE) { > > + } else if (action & IMA_FORCE || inode->i_sb->s_type->fs_flags & FS_NO_IMA_CACHE) { > > if (action & IMA_MEASURE) { > > iint->measured_pcrs = 0; > > iint->flags &= > > -- > > 2.13.6 > > >