lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 18 Oct 2022 16:50:13 +0200 From: Christian Brauner <brauner@...nel.org> To: Kees Cook <keescook@...omium.org> Cc: Mimi Zohar <zohar@...ux.ibm.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>, Paul Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, Takashi Iwai <tiwai@...e.de>, Jonathan McDowell <noodles@...com>, Casey Schaufler <casey@...aufler-ca.com>, linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, Mickaël Salaün <mic@...ikod.net>, KP Singh <kpsingh@...nel.org>, John Johansen <john.johansen@...onical.com>, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, fsdevel@...r.kernel.org Subject: Re: [PATCH 5/9] LSM: Introduce inode_post_setattr hook On Thu, Oct 13, 2022 at 03:36:50PM -0700, Kees Cook wrote: > IMA and EVM need to hook after setattr finishes. Introduce this hook and > move IMA and EVM's open-coded stacking to use it. > > Cc: Mimi Zohar <zohar@...ux.ibm.com> > Cc: Dmitry Kasatkin <dmitry.kasatkin@...il.com> > Cc: Paul Moore <paul@...l-moore.com> > Cc: James Morris <jmorris@...ei.org> > Cc: "Serge E. Hallyn" <serge@...lyn.com> > Cc: Takashi Iwai <tiwai@...e.de> > Cc: Jonathan McDowell <noodles@...com> > Cc: Casey Schaufler <casey@...aufler-ca.com> > Cc: linux-integrity@...r.kernel.org > Cc: linux-security-module@...r.kernel.org > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > fs/attr.c | 3 +-- > include/linux/evm.h | 6 ------ > include/linux/ima.h | 9 --------- > include/linux/lsm_hook_defs.h | 3 +++ > security/integrity/evm/evm_main.c | 10 +++++++++- > security/integrity/ima/ima.h | 2 ++ > security/integrity/ima/ima_appraise.c | 2 +- > security/integrity/ima/ima_main.c | 1 + > security/security.c | 8 ++++++++ > 9 files changed, 25 insertions(+), 19 deletions(-) > > diff --git a/fs/attr.c b/fs/attr.c > index 1552a5f23d6b..e5731057426b 100644 > --- a/fs/attr.c > +++ b/fs/attr.c > @@ -423,8 +423,7 @@ int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry, > > if (!error) { > fsnotify_change(dentry, ia_valid); > - ima_inode_post_setattr(mnt_userns, dentry); > - evm_inode_post_setattr(dentry, ia_valid); > + security_inode_post_setattr(mnt_userns, dentry, ia_valid); I like that change. In general, no more separate evm_* and ima_* invocations in the vfs would be much appreciated.
Powered by blists - more mailing lists