linux-kernel - Re: [PATCH] integrity: add ima_counts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 03 Jul 2009 13:02:41 +0900
From:	hooanon05@...oo.co.jp
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	linux-kernel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	David Safford <safford@...son.ibm.com>,
	Mimi Zohar <zohar@...ibm.com>
Subject: Re: [PATCH] integrity: add ima_counts_put (updated) 


Mimi Zohar:
> NFSv3 is an interesting example. Permission checking is done once,
> followed by multiple open/read/close calls. Incrementing the counters in
> nfsd_permission() once and decrementing the counters in close, multiple
> times, resulted in imbalance messages.  True, the solution in this case
> was to increment in open and decrement in close, but that was only part
> of the solution.  The other part of the solution, the important part,
> was to add a call to ima_path_check() to measure the file.

Let me make sure.
Does "that was only part of the solution" mean IMA does not work for
NFSD fully? To make IMA work fully, is incrementing before open
absolutely necessary?


J. R. Okajima
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/