linux-kernel - Re: [RFC][Patch 5/5]integrity: IMA as an integrity service provider

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 29 May 2008 19:04:27 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	linux-kernel@...r.kernel.org, safford@...son.ibm.com,
	serue@...ux.vnet.ibm.com, sailer@...son.ibm.com, zohar@...ibm.com,
	sds@...ho.nsa.gov, casey@...aufler-ca.com
Subject: Re: [RFC][Patch 5/5]integrity: IMA as an integrity service provider

On Thu, 29 May 2008 21:58:08 -0400 Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:

> > erk, I'm not an i_version person.  It seems that it's only used on
> > directories (to patch up readdir coherency problems) so I guess I
> > misled you there.
> 
> No, no.  Initially, that's what I thought. I finally found
> file_update_time() calls inode_inc_iversion(), which updates 
> the i_version.  So, it does work.  The question is whether
> or not it works all the time. :-)

OK.

Before 2.6.17 it wouldn't have worked much at all on MAP_SHARED
modifications.

After 2.6.17 things will be better - we update the mtime on the
clean->dirty transitions of a page.  So the first modification after an
mmap will update the time.

Subsequent modifications via the mmap will not update the file time. 
Until something (usually pdflush) writes the page out.  Then the next
modification via mmap will cause another clean->dirty transition on the
page, hence another mtime update.

So there's a by-default 30-odd second uncertainty with MAP_SHARED
alterations.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/