linux-kernel - Re: IMA & truncate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACE9dm_Wgndgx_tdvZ=P5jY6AGq=utMxNqU+UrYhguj67PKU6Q@mail.gmail.com>
Date:	Wed, 7 May 2014 08:45:19 +0300
From:	Dmitry Kasatkin <dmitry.kasatkin@...il.com>
To:	Al Viro <viro@...iv.linux.org.uk>
Cc:	Dmitry Kasatkin <d.kasatkin@...sung.com>,
	linux-security-module <linux-security-module@...r.kernel.org>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: IMA & truncate

On 6 May 2014 19:59, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote:
>> Hi,
>>
>> I have discovered one IMA related issue.
>>
>> IMA file hash is re-calculate if needed on file close.
>>
>> It works with ftruncate(fd, length) syscall, because it operates on
>> "opened" file.
>> Recalculation is happening on file close.
>>
>> truncate(path, length) syscall works with path and no file open/close
>> takes place.
>> Recalculation does not happen.
>> IMA denies file access later.
>>
>> It looks like vfs_truncate() should possibly call IMA to recalculate the
>> hash.
>
> Who said that it has permissions to read the file?  Reread truncate(2)
> manpage; it requires the file to be *writable* for caller, but it doesn't
> need it to be readable.

Sorry for repost. Lousy Android gmail client is not able to send with
plain text, even with reply.

This is the same case as for normal file close.
IMA will do file reading for the purpose of calculating a hash, even
file was opened for writing only. File reading is done when the last
writer closes the file and it is protected by mutex. Subsequent file
open is delayed by the mutex.

> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html



-- 
Thanks,
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/