lkml.org 
[lkml]   [2021]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 2/2] fs: extend the trusted_for syscall to call IMA
From
Date
On 10/13/2021 8:45 AM, Mimi Zohar wrote:
> [CC'ing Casey]
>
> On Wed, 2021-10-13 at 17:26 +0200, Mickaël Salaün wrote:
>> Nice!
>>
>> On 13/10/2021 13:01, Mimi Zohar wrote:
>>> Extend the trusted_for syscall to call the newly defined
>>> ima_trusted_for hook.
>>>
>>> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
>>> ---
>>> fs/open.c | 3 +++
>>> include/linux/ima.h | 9 +++++++++
>>> 2 files changed, 12 insertions(+)
>>>
>>> diff --git a/fs/open.c b/fs/open.c
>>> index c79c138a638c..4d54e2a727e1 100644
>>> --- a/fs/open.c
>>> +++ b/fs/open.c
>>> @@ -585,6 +585,9 @@ SYSCALL_DEFINE3(trusted_for, const int, fd, const enum trusted_for_usage, usage,
>>> err = inode_permission(file_mnt_user_ns(f.file), inode,
>>> mask | MAY_ACCESS);
>>>
>>> + if (!err)
>>> + err = ima_trusted_for(f.file, usage);
>> Could you please implement a new LSM hook instead? Other LSMs may want
>> to use this information as well.
> Casey normally pushes back on my defining a new LSM hook, when IMA is
> the only user. If any of the LSM maintainers are planning on defining
> this hook, please chime in.

That's correct. Adding the overhead of checking for security module hooks
when we know there aren't any does nothing to dispel the perception that
security developers don't care about performance.


> thanks,
>
> Mimi
>

\
 
 \ /
  Last update: 2021-10-13 19:25    [W:0.174 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site