linux-kernel - Re: [PATCH] integrity: add ima_counts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1246313060.3280.81.camel@dyn9002018117.watson.ibm.com>
Date:	Mon, 29 Jun 2009 18:04:20 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	hooanon05@...oo.co.jp
Cc:	linux-kernel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	David Safford <safford@...son.ibm.com>,
	Mimi Zohar <zohar@...ibm.com>
Subject: Re: [PATCH] integrity: add ima_counts_put (updated)

On Tue, 2009-06-30 at 05:36 +0900, hooanon05@...oo.co.jp wrote:
> Mimi Zohar:
> > This suggestion has been mentioned before; and yes would definitely
> > resolve the annoying imbalance and iint_free() messages.  But
> > incrementing/decrementing the pointers automatically each time a file is
> > opened/closed would defeat their purpose - alerting us that a file was
> > possibly not measured before being read/executed. 
> 
> I may be wrong since I don't fully understand IMA's purpose, but why did
> you create ima_counts_get() and make it call after dentry_open() in
> nfsd_open()? Isn't it same thing essentially?
> 
> 
> J. R. Okajima

NFSv3 is an interesting example. Permission checking is done once,
followed by multiple open/read/close calls. Incrementing the counters in
nfsd_permission() once and decrementing the counters in close, multiple
times, resulted in imbalance messages.  True, the solution in this case
was to increment in open and decrement in close, but that was only part
of the solution.  The other part of the solution, the important part,
was to add a call to ima_path_check() to measure the file.

The imbalance message did what it was suppose to do - highlight the fact
that a file was read/executed without first being measured.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/