lkml.org 
[lkml]   [2014]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: IMA & truncate
From
On 6 May 2014 19:59, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote:
>> Hi,
>>
>> I have discovered one IMA related issue.
>>
>> IMA file hash is re-calculate if needed on file close.
>>
>> It works with ftruncate(fd, length) syscall, because it operates on
>> "opened" file.
>> Recalculation is happening on file close.
>>
>> truncate(path, length) syscall works with path and no file open/close
>> takes place.
>> Recalculation does not happen.
>> IMA denies file access later.
>>
>> It looks like vfs_truncate() should possibly call IMA to recalculate the
>> hash.
>
> Who said that it has permissions to read the file? Reread truncate(2)
> manpage; it requires the file to be *writable* for caller, but it doesn't
> need it to be readable.

Sorry for repost. Lousy Android gmail client is not able to send with
plain text, even with reply.

This is the same case as for normal file close.
IMA will do file reading for the purpose of calculating a hash, even
file was opened for writing only. File reading is done when the last
writer closes the file and it is protected by mutex. Subsequent file
open is delayed by the mutex.

> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html



--
Thanks,
Dmitry


\
 
 \ /
  Last update: 2014-05-07 08:01    [W:0.057 / U:0.356 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site