Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751737AbdIQPiD (ORCPT ); Sun, 17 Sep 2017 11:38:03 -0400 Received: from bombadil.infradead.org ([65.50.211.133]:50780 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751408AbdIQPh7 (ORCPT ); Sun, 17 Sep 2017 11:37:59 -0400 Date: Sun, 17 Sep 2017 08:37:55 -0700 From: Christoph Hellwig To: Linus Torvalds Cc: Christoph Hellwig , Mimi Zohar , LSM List , Christoph Hellwig , linux-ima-devel@lists.sourceforge.net, James Morris , Linux Kernel Mailing List , Matthew Garrett , Jan Kara , "Theodore Ts'o" , Andreas Dilger , Jaegeuk Kim , Chao Yu , Steven Whitehouse , Bob Peterson , David Woodhouse , Dave Kleikamp , Ryusuke Konishi , Mark Fasheh , Joel Becker , Richard Weinberger , "Darrick J. Wong" , Hugh Dickins , Chris Mason Subject: Re: [PATCH 3/3] ima: use fs method to read integrity data (updated patch description) Message-ID: <20170917153755.GA21193@infradead.org> References: <1505451494-30228-1-git-send-email-zohar@linux.vnet.ibm.com> <1505451494-30228-4-git-send-email-zohar@linux.vnet.ibm.com> <1505507142.4200.103.camel@linux.vnet.ibm.com> <20170917151757.GA14262@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.8.3 (2017-05-23) X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1108 Lines: 24 On Sun, Sep 17, 2017 at 08:28:40AM -0700, Linus Torvalds wrote: > The issue is that somebody else can come in - using direct IO - at the > same time as the first person is collecting measurements, and thus > race with the collector. > > So now the measurements are not trustworthy any more. Yes. And it's always been that way with IMA. > .. and *my* point is that it's the wrong lock for actually checking > integrity (it doesn't actually guarantee exclusion, even though in > practice it's almost always the case), and so we're adding a nasty > callback that in 99% of all cases is the same as the normal read, and > we *could* have just added it with a RWF flag instead. > > Is there some reason why integrity has to use that particular lock > that is so inconvenient for the filesystems it wants to check? I'll have to defer that to Mimi - I just jumped into this whole mess to help fixing the deadlocks we saw on XFS and NFS. Unfortunately the whole security code is a giant mess that doesn't document assumptions, threat models or gets any sort of verification of those through automated testing.