linux-kernel - Re: [PATCH 2/4] integrity: special fs magic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 8 Aug 2008 16:07:43 -0700
From:	Greg KH <greg@...ah.com>
To:	Mimi Zohar <zohar@...ibm.com>
Cc:	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Randy Dunlap <randy.dunlap@...cle.com>, safford@...son.ibm.com,
	sailer@...son.ibm.com, Stephen Smalley <sds@...ho.nsa.gov>,
	serue@...ux.vnet.ibm.com, Al Viro <viro@...IV.linux.org.uk>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Subject: Re: [PATCH 2/4] integrity: special fs magic

On Fri, Aug 08, 2008 at 03:50:02PM -0400, Mimi Zohar wrote:
> Greg KH <greg@...ah.com> wrote on 08/08/2008 03:15:19 PM:
> 
> > On Fri, Aug 08, 2008 at 12:04:48PM -0700, Greg KH wrote:
> > > On Fri, Aug 08, 2008 at 02:55:42PM -0400, Mimi Zohar wrote:
> > > >     - Move special fs magic number definitions to magic.h
> > > >     - Add magic.h include
> > > > 
> > > >     Signed-off-by: Mimi Zohar <zohar@...ibm.com>
> > > 
> > > Why?  What is this patch for?  Are you going to do something with 
> these
> > > magic values later?
> > 
> > Ok, I now see the follow-up patch that does something with them.
> > 
> > You should say so in this patch.
> > 
> > And is it really ok to be doing things from userspace based on a
> > filesystem "magic" key?  Those are numbers we have never exported to
> > userspace before, what happens if they are changed?
> > 
> > thanks,
> > 
> > greg k-h
> 
> Userspace only loads the measurement policy (via securityfs), and if
> a magic number changes, and the policy is not updated to match, then
> we would end up measuring some filesystems we didn't need to.  Before 
> the magic numbers were hard coded in IMA, now at least, it's extensible. 

Why not just use a name then instead?  That way if the number changes
within the kernel, then it will always be right.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/