From: Christoph Hellwig <hch@infradead.org>
To: Dongsu Park <dongsu@kinvolk.io>
Cc: linux-kernel@vger.kernel.org, Alban Crequy <alban@kinvolk.io>,
Miklos Szeredi <miklos@szeredi.hu>,
Mimi Zohar <zohar@linux.vnet.ibm.com>,
Seth Forshee <seth.forshee@canonical.com>
Subject: Re: [PATCH 0/2] turn on force option for FUSE in builtin policies
Date: Mon, 15 Jan 2018 06:48:04 -0800 [thread overview]
Message-ID: <20180115144804.GA28856@infradead.org> (raw)
In-Reply-To: <cover.1515682581.git.dongsu@kinvolk.io>
On Thu, Jan 11, 2018 at 08:51:48PM +0100, Dongsu Park wrote:
> In case of FUSE filesystem, cached integrity results in IMA could be
> reused, when the userspace FUSE process has changed the
> underlying files. To be able to avoid such cases, we need to turn on
> the force option in builtin policies, for actions of measure and
> appraise. Then integrity values become re-measured and re-appraised.
> In that way, cached integrity results won't be used.
The same is true for any distributed file system. Checking for magic
numbers is always the wrong thing. You'll need flags for specific
behavior in struct file_system_type instead.
next prev parent reply other threads:[~2018-01-15 14:48 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-11 19:51 [PATCH 0/2] turn on force option for FUSE in builtin policies Dongsu Park
2018-01-11 19:51 ` [PATCH 1/2] fs/fuse: move SUPER_MAGIC definitions to linux/magic.h Dongsu Park
2018-01-11 19:51 ` [PATCH 2/2] ima: turn on force option for FUSE in builtin policies Dongsu Park
2018-01-12 15:33 ` Mimi Zohar
2018-01-14 19:09 ` kbuild test robot
2018-01-16 10:47 ` Dongsu Park
2018-01-15 14:48 ` Christoph Hellwig [this message]
2018-01-15 16:32 ` [PATCH 0/2] " Mimi Zohar
2018-01-15 17:18 ` Christoph Hellwig
2018-01-15 21:00 ` Mimi Zohar
2018-01-16 10:41 ` [PATCH] ima,fuse: introduce new fs flag FS_NO_IMA_CACHE Alban Crequy
2018-01-16 11:26 ` Alban Crequy
2018-01-16 11:35 ` Mimi Zohar
2018-01-16 11:09 ` [PATCH 0/2] turn on force option for FUSE in builtin policies Dongsu Park
2018-01-16 11:23 ` Mimi Zohar
2018-01-16 14:05 ` Dongsu Park
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180115144804.GA28856@infradead.org \
--to=hch@infradead.org \
--cc=alban@kinvolk.io \
--cc=dongsu@kinvolk.io \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=seth.forshee@canonical.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox