lkml.org 
[lkml]   [2020]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 0/3] fs: reduce export usage of kerne_read*() calls
    From
    Date
    Hi Christoph,

    On Sun, 2020-05-17 at 23:22 -0700, Christoph Hellwig wrote:
    > On Fri, May 15, 2020 at 09:29:33PM +0000, Luis Chamberlain wrote:
    > > On Wed, May 13, 2020 at 11:17:36AM -0700, Christoph Hellwig wrote:
    > > > Can you also move kernel_read_* out of fs.h? That header gets pulled
    > > > in just about everywhere and doesn't really need function not related
    > > > to the general fs interface.
    > >
    > > Sure, where should I dump these?
    >
    > Maybe a new linux/kernel_read_file.h? Bonus points for a small top
    > of the file comment explaining the point of the interface, which I
    > still don't get :)

    Instead of rolling your own method of having the kernel read a file,
    which requires call specific security hooks, this interface provides a
    single generic set of pre and post security hooks.  The
    kernel_read_file_id enumeration permits the security hook to
    differentiate between callers.

    To comply with secure and trusted boot concepts, a file cannot be
    accessible to the caller until after it has been measured and/or the
    integrity (hash/signature) appraised.

    In some cases, the file was previously read twice, first to measure
    and/or appraise the file and then read again into a buffer for
    use.  This interface reads the file into a buffer once, calls the
    generic post security hook, before providing the buffer to the caller.
     (Note using firmware pre-allocated memory might be an issue.)

    Partial reading firmware will result in needing to pre-read the entire
    file, most likely on the security pre hook.

    Mimi

    \
     
     \ /
      Last update: 2020-05-18 14:39    [W:3.635 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site