linux-kernel - Re: [PATCH 3/3] ima: use fs method to read integrity data (updated patch description)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 16 Sep 2017 11:20:47 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:     LSM List <linux-security-module@...r.kernel.org>,
        Christoph Hellwig <hch@....de>,
        linux-ima-devel@...ts.sourceforge.net,
        Christoph Hellwig <hch@...radead.org>,
        James Morris <jmorris@...ei.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Jan Kara <jack@...e.com>, "Theodore Ts'o" <tytso@....edu>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        Jaegeuk Kim <jaegeuk@...nel.org>, Chao Yu <yuchao0@...wei.com>,
        Steven Whitehouse <swhiteho@...hat.com>,
        Bob Peterson <rpeterso@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Dave Kleikamp <shaggy@...nel.org>,
        Ryusuke Konishi <konishi.ryusuke@....ntt.co.jp>,
        Mark Fasheh <mfasheh@...sity.com>,
        Joel Becker <jlbec@...lplan.org>,
        Richard Weinberger <richard@....at>,
        "Darrick J. Wong" <darrick.wong@...cle.com>,
        Hugh Dickins <hughd@...gle.com>, Chris Mason <clm@...com>
Subject: Re: [PATCH 3/3] ima: use fs method to read integrity data (updated
 patch description)

On Fri, Sep 15, 2017 at 1:25 PM, Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
>
> To resolve this locking problem, this patch defines a new
> ->integrity_read file operation method, which is equivalent to
> ->read_iter, except that it will not take the i_rwsem lock, but will
> be called with the i_rwsem held exclusively.
>
> Since taking the i_rwsem exclusively is not required for reading the
> file in order to calculate the file hash, the code only verifies
> that the lock has been taken.

Ok, so I'm onboard with the commit message now, but realized that I'm
not actually convinced that i_rwsem is even meaningful.

Sure, generic_file_write_iter() does take that lock exclusively, but
not everybody uses generic_file_write_iter() at all for writing.

For example, xfs still uses that i_rwsem, but for block-aligned writes
it will only get it shared. And I'm not convinced some other
filesystem might not end up using some other lock entirely.

So I'm basically not entirely convinced that these i_rwsem games make
any sense at all.

The filesystem can do its own locking, and I'm starting to think that
it would be better to just pass this "this is an integrity read" down
to the filesystem, and expect the filesystem to do the locking based
on that.

                 Linus