lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 17 Sep 2017 08:28:40 -0700
From:   Linus Torvalds <>
To:     Christoph Hellwig <>
Cc:     Mimi Zohar <>,
        LSM List <>,
        Christoph Hellwig <>,,
        James Morris <>,
        Linux Kernel Mailing List <>,
        Matthew Garrett <>,
        Jan Kara <>, "Theodore Ts'o" <>,
        Andreas Dilger <>,
        Jaegeuk Kim <>, Chao Yu <>,
        Steven Whitehouse <>,
        Bob Peterson <>,
        David Woodhouse <>,
        Dave Kleikamp <>,
        Ryusuke Konishi <>,
        Mark Fasheh <>,
        Joel Becker <>,
        Richard Weinberger <>,
        "Darrick J. Wong" <>,
        Hugh Dickins <>, Chris Mason <>
Subject: Re: [PATCH 3/3] ima: use fs method to read integrity data (updated
 patch description)

On Sun, Sep 17, 2017 at 8:17 AM, Christoph Hellwig <> wrote:
> Only for direct I/O, and IMA and direct I/O don't work together.
> From ima_collect_measurement:
>                 if (file->f_flags & O_DIRECT) {
>                         audit_cause = "failed(directio)";
>                         result = -EACCES;
>                         goto out;
>                 }

That's not the issue.

The issue is that somebody else can come in - using direct IO - at the
same time as the first person is collecting measurements, and thus
race with the collector.

So now the measurements are not trustworthy any more.

> Well, that's exactly the point of the new ->integrity_read routine
> I proposed and prototype.  The important thing is that it is called
> with i_rwsem held because code mugh higher in the chain already
> acquired it, but except for that it's entirely up to the file system.

.. and *my* point is that it's the wrong lock for actually checking
integrity (it doesn't actually guarantee exclusion, even though in
practice it's almost always the case), and so we're adding a nasty
callback that in 99% of all cases is the same as the normal read, and
we *could* have just added it with a RWF flag instead.

Is there some reason why integrity has to use that particular lock
that is so inconvenient for the filesystems it wants to check?


Powered by blists - more mailing lists