linux-kernel - Re: [RESEND][PATCH] ima: Set and clear FMODE_CAN_READ in ima_calc_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c556508437ffc10d3873fe25cbbba3484ca574df.camel@linux.ibm.com>
Date:   Mon, 16 Nov 2020 11:46:52 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Christoph Hellwig <hch@...radead.org>,
        Roberto Sassu <roberto.sassu@...wei.com>
Cc:     "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Silviu Vlasceanu <Silviu.Vlasceanu@...wei.com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: [RESEND][PATCH] ima: Set and clear FMODE_CAN_READ in
 ima_calc_file_hash()

On Mon, 2020-11-16 at 16:22 +0000, Christoph Hellwig wrote:
> On Mon, Nov 16, 2020 at 08:52:19AM +0000, Roberto Sassu wrote:
> > FMODE_CAN_READ was not set because f_mode does not have
> > FMODE_READ. In the patch, I check if the former can be set
> > similarly to the way it is done in file_table.c and open.c.
> > 
> > Is there a better way to read a file when the file was not opened
> > for reading and a new file descriptor cannot be created?
> 
> You can't open a file not open for reading.  The file system or device
> driver might have to prepare read-specific resources in ->open to
> support reads.  So what you'll have to do is to open a new instance
> of the file that is open for reading.

This discussion seems to be going down the path of requiring an IMA
filesystem hook for reading the file, again.  That solution was
rejected, not by me.  What is new this time?

Mimi