linux-kernel - Re: IMA & truncate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 7 May 2014 08:46:38 +0300
From:	Dmitry Kasatkin <dmitry.kasatkin@...il.com>
To:	Al Viro <viro@...iv.linux.org.uk>
Cc:	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Dmitry Kasatkin <d.kasatkin@...sung.com>,
	linux-security-module <linux-security-module@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: IMA & truncate

On 6 May 2014 22:11, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote:
>
>> Al, you're not going to like this, but ima_calc_file_hash() calls
>> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order
>> to calculate the file hash.
>
> And if it happens to be on NFS and server says "no reads for you"?

Sorry for repost. Lousy Android gmail client is not able to send with
plain text, even with reply.

IMA works by policy. It ignores non-local file systems by default.

But if someone still tries to enable nfs in the custom policy, it
might get into such situation. But then there are other issues like
security xattrs. Anyone using ima needs to be aware what he does.


> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


-- 
Thanks,
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/