Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753253AbdHKPBF (ORCPT ); Fri, 11 Aug 2017 11:01:05 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:59250 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752869AbdHKPBD (ORCPT ); Fri, 11 Aug 2017 11:01:03 -0400 Subject: Re: [RFC PATCH 2/5] ima: Add ns_status for storing namespaced iint data To: Mehmet Kayaalp , ima-devel References: <20170720225033.21298-1-mkayaalp@linux.vnet.ibm.com> <20170720225033.21298-3-mkayaalp@linux.vnet.ibm.com> Cc: containers , linux-kernel , linux-security-module , Tycho Andersen , "Serge E . Hallyn" , Yuqiong Sun , David Safford , Mehmet Kayaalp From: Stefan Berger Date: Fri, 11 Aug 2017 11:00:52 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <20170720225033.21298-3-mkayaalp@linux.vnet.ibm.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 17081115-0048-0000-0000-000001D245B9 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00007525; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000220; SDB=6.00900799; UDB=6.00451015; IPR=6.00681003; BA=6.00005523; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00016647; XFM=3.00000015; UTC=2017-08-11 15:01:01 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17081115-0049-0000-0000-00004232C097 Message-Id: <9a2ae1ef-95c3-6eb3-bf4d-78b84d5a77e4@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-08-11_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=2 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000 definitions=main-1708110241 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1678 Lines: 45 On 07/20/2017 06:50 PM, Mehmet Kayaalp wrote: > This patch adds an rbtree to the IMA namespace structure that stores a > namespaced version of iint->flags in ns_status struct. Similar to the > integrity_iint_cache, both the iint ns_struct are looked up using the > inode pointer value. The lookup, allocate, and insertion code is also > similar, except ns_struct is not free'd when the inode is free'd. > Instead, the lookup verifies the i_ino and i_generation fields are also a > match. A lazy clean up of the rbtree that removes free'd inodes could be > implemented to reclaim the invalid entries. > > Signed-off-by: Mehmet Kayaalp > --- > include/linux/ima.h | 3 + > security/integrity/ima/ima.h | 16 ++++++ > security/integrity/ima/ima_ns.c | 120 ++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 139 insertions(+) > > > @@ -181,3 +198,106 @@ struct ima_namespace init_ima_ns = { > .parent = NULL, > }; > EXPORT_SYMBOL(init_ima_ns); > + > +/* > + * __ima_ns_status_find - return the ns_status associated with an inode > + */ > +static struct ns_status *__ima_ns_status_find(struct ima_namespace *ns, > + struct inode *inode) > +{ > + struct ns_status *status; > + struct rb_node *n = ns->ns_status_tree.rb_node; > + > + while (n) { > + status = rb_entry(n, struct ns_status, rb_node); > + > + if (inode < status->inode) > + n = n->rb_left; > + else if (inode->i_ino > status->i_ino) > + n = n->rb_right; Above you are comparing with the inode ptr, here with i_ino. Why can you not compare with inode both times. Also the insertion only seems to consider the inode ptr. Stefan