From: Mimi Zohar <zohar@linux.ibm.com>
To: Chuck Lever <chuck.lever@oracle.com>
Cc: Bruce Fields <bfields@fieldses.org>,
Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
linux-integrity@vger.kernel.org,
"Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [PATCH v2 3/5] NFSD: Remove ima_file_check call
Date: Mon, 25 Mar 2019 11:01:57 -0400 [thread overview]
Message-ID: <1553526117.3929.32.camel@linux.ibm.com> (raw)
In-Reply-To: <E51D17F4-5641-48D9-A2A2-56D13F44DF75@oracle.com>
On Mon, 2019-03-25 at 10:24 -0400, Chuck Lever wrote:
> Auditing can be done by keeping the ima_file_check call site but
> ignoring its return code, for example.
Neither the "measure" or "audit" rules control the return code. Only
an IMA "appraise" rule verifies a file's integrity, which could fail,
resulting in an error return code.
Different systems might have different requirements. Having the IMA
hook here, allows IMA custom policies to be defined, based on the
specific system requirements.
In terms of performance, IMA calculates the file hash once, which can
then be used for measuring, appraising, and auditing. Unless the file
changes, calculating the file hash is only done once.
> In any event, removing the ima_file_check call is not required for
> the prototype to be functional. I can drop this patch for now, but
> I encourage examination of how the NFS server measures and audits
> files when an actual IMA policy is in effect.
Thank you!
Mimi
next prev parent reply other threads:[~2019-03-25 15:03 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-07 15:28 [PATCH v2 0/5] RFC: Linux IMA on NFS prototype Chuck Lever
2019-03-07 15:28 ` [PATCH v2 1/5] NFS: Define common IMA-related protocol elements Chuck Lever
2019-03-07 15:28 ` [PATCH v2 2/5] NFSD: Prototype support for IMA on NFS (server) Chuck Lever
2019-03-07 15:28 ` [PATCH v2 3/5] NFSD: Remove ima_file_check call Chuck Lever
2019-03-08 21:10 ` J. Bruce Fields
2019-03-08 21:11 ` Chuck Lever
2019-03-08 21:23 ` Bruce Fields
2019-03-08 21:29 ` Chuck Lever
2019-03-19 20:29 ` Mimi Zohar
2019-03-20 13:40 ` Chuck Lever
2019-03-21 11:44 ` Mimi Zohar
2019-03-21 14:04 ` Chuck Lever
2019-03-22 22:55 ` Mimi Zohar
2019-03-25 14:24 ` Chuck Lever
2019-03-25 15:01 ` Mimi Zohar [this message]
2019-03-07 15:28 ` [PATCH v2 4/5] NFS: Rename security xattr handler Chuck Lever
2019-03-07 15:29 ` [PATCH v2 5/5] NFS: Prototype support for IMA on NFS (client) Chuck Lever
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1553526117.3929.32.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bfields@fieldses.org \
--cc=chuck.lever@oracle.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).