From: Matthew Garrett <mjg59@google.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-integrity <linux-integrity@vger.kernel.org>,
james.l.morris@oracle.com, keescook@chromium.org,
oleg@redhat.com
Subject: Re: [PATCH V3 2/2] Add a bprm_interpreted security hook and call into IMA from it
Date: Mon, 16 Oct 2017 11:13:20 -0700 [thread overview]
Message-ID: <CACdnJutj6rgy6hd1yMDO85ihUoCakRQDTG570Qk=_M-hrzURWA@mail.gmail.com> (raw)
In-Reply-To: <1508076505.3426.139.camel@linux.vnet.ibm.com>
On Sun, Oct 15, 2017 at 7:08 AM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> Even with this additional patch, there are still potentially missing measurements/appraisals as search_binary_handler is exported. The original search_binary_handler is called twice, once for the original file and again for the interpreter. With these patches, the security hooks are deferred, requiring calls in the specific binary handler.
>
> For your usecase scenario this might be enough, but for the general case the security_bprm_check hooks would still be needed.
Mm. Yeah. Ok let me try tackling this in a different way.
prev parent reply other threads:[~2017-10-16 18:13 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-11 19:12 [PATCH V3 1/2] IMA: Add support for IMA validation after credentials are committed Matthew Garrett
2017-10-11 19:12 ` [PATCH V3 2/2] Add a bprm_interpreted security hook and call into IMA from it Matthew Garrett
2017-10-15 14:08 ` Mimi Zohar
2017-10-16 18:13 ` Matthew Garrett [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACdnJutj6rgy6hd1yMDO85ihUoCakRQDTG570Qk=_M-hrzURWA@mail.gmail.com' \
--to=mjg59@google.com \
--cc=james.l.morris@oracle.com \
--cc=keescook@chromium.org \
--cc=linux-integrity@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.