Messages in this thread | | | Date | Wed, 21 Apr 2010 15:23:23 -0700 | From | Randy Dunlap <> | Subject | Re: [PATCH 00/14] EVM |
| |
On 04/21/10 15:18, Mimi Zohar wrote: > On Wed, 2010-04-21 at 14:58 -0700, Randy Dunlap wrote: >> On Wed, 21 Apr 2010 17:49:40 -0400 Mimi Zohar wrote: >> >>> Extended Verification Module(EVM) detects offline tampering of the >>> security extended attributes (e.g. security.selinux, security.SMACK64, >>> security.ima), which is the basis for LSM permission decisions and, >>> with this set of patches, integrity appraisal decisions. To detect >>> offline tampering of the extended attributes, EVM maintains an >>> HMAC-sha1 across a set of security extended attributes, storing the >>> HMAC as the extended attribute 'security.evm'. To verify the integrity >>> of an extended attribute, EVM exports evm_verifyxattr(), which >>> re-calculates the HMAC and compares it with the version stored in >>> 'security.evm'. >>> >> ... >>> >>> Much appreciation to Dave Hansen, Serge Hallyn, and Matt Helsley for >>> reviewing the patches. >>> >>> Mimi >>> >>> Mimi Zohar (14): >>> integrity: move ima inode integrity data management >>> security: move LSM xattrnames to xattr.h >>> xattr: define vfs_getxattr_alloc and vfs_xattr_cmp >>> evm: re-release >>> ima: move ima_file_free before releasing the file >>> security: imbed evm calls in security hooks >>> evm: inode post removexattr >>> evm: imbed evm_inode_post_setattr >>> evm: inode_post_init >>> fs: add evm_inode_post_init calls >>> ima: integrity appraisal extension >>> ima: appraise default rules >>> ima: inode post_setattr >>> ima: add ima_inode_setxattr and ima_inode_removexattr >>> -- >> >> A summary diffstat would be good to see in patch 00/14. >> >> Lacking that, at least each individual patch should have a diffstat summary >> in it. Please read Documentation/SubmittingPatches. >> >> --- >> ~Randy > > Only two minor changes from the RFC posting: > > 0011-ima-integrity-appraisal-extension.patch adds a missing > ima_fix_xattr() call.
diffstat summary example, from a series of 35 filesystem patches:
Documentation/filesystems/union-mounts.txt | 708 ++++++++++++++++++++++ Documentation/filesystems/vfs.txt | 16 +- fs/Kconfig | 13 + fs/Makefile | 1 + fs/autofs4/autofs_i.h | 1 + fs/autofs4/init.c | 11 +- fs/autofs4/root.c | 6 + fs/compat.c | 9 + fs/dcache.c | 35 +- fs/ext2/dir.c | 248 +++++++- fs/ext2/ext2.h | 4 + fs/ext2/inode.c | 11 +- fs/ext2/namei.c | 89 +++- fs/ext2/super.c | 6 + fs/jffs2/dir.c | 104 ++++- fs/jffs2/fs.c | 4 + fs/jffs2/super.c | 2 +- fs/libfs.c | 21 +- fs/namei.c | 793 ++++++++++++++++++++++--- fs/namespace.c | 146 +++++- fs/nfsd/nfs3xdr.c | 5 + fs/nfsd/nfs4xdr.c | 5 + fs/nfsd/nfsxdr.c | 4 + fs/open.c | 116 +++- fs/readdir.c | 18 + fs/super.c | 23 + fs/union.c | 881 ++++++++++++++++++++++++++++ fs/utimes.c | 13 +- include/linux/dcache.h | 40 ++ include/linux/ext2_fs.h | 5 + include/linux/fs.h | 16 + include/linux/jffs2.h | 8 + include/linux/mount.h | 7 +- include/linux/namei.h | 2 + include/linux/union.h | 77 +++ mm/shmem.c | 195 ++++++- 36 files changed, 3483 insertions(+), 160 deletions(-) create mode 100644 Documentation/filesystems/union-mounts.txt create mode 100644 fs/union.c create mode 100644 include/linux/union.h
This summarizes which files are changed and how much, so that interested people can know if they want to review the patches.
-- ~Randy
| |