lkml.org 
[lkml]   [2014]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: IMA & truncate
From
On 6 May 2014 22:11, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote:
>
>> Al, you're not going to like this, but ima_calc_file_hash() calls
>> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order
>> to calculate the file hash.
>
> And if it happens to be on NFS and server says "no reads for you"?

Sorry for repost. Lousy Android gmail client is not able to send with
plain text, even with reply.

IMA works by policy. It ignores non-local file systems by default.

But if someone still tries to enable nfs in the custom policy, it
might get into such situation. But then there are other issues like
security xattrs. Anyone using ima needs to be aware what he does.


> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html


--
Thanks,
Dmitry


\
 
 \ /
  Last update: 2014-05-07 08:01    [W:0.045 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site