Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751584AbdIQQP6 (ORCPT ); Sun, 17 Sep 2017 12:15:58 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:34008 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751466AbdIQQPz (ORCPT ); Sun, 17 Sep 2017 12:15:55 -0400 Subject: Re: [PATCH 3/3] ima: use fs method to read integrity data (updated patch description) From: Mimi Zohar To: Linus Torvalds , Christoph Hellwig Cc: LSM List , Christoph Hellwig , linux-ima-devel@lists.sourceforge.net, James Morris , Linux Kernel Mailing List , Matthew Garrett , Jan Kara , "Theodore Ts'o" , Andreas Dilger , Jaegeuk Kim , Chao Yu , Steven Whitehouse , Bob Peterson , David Woodhouse , Dave Kleikamp , Ryusuke Konishi , Mark Fasheh , Joel Becker , Richard Weinberger , "Darrick J. Wong" , Hugh Dickins , Chris Mason Date: Sun, 17 Sep 2017 12:15:35 -0400 In-Reply-To: References: <1505451494-30228-1-git-send-email-zohar@linux.vnet.ibm.com> <1505451494-30228-4-git-send-email-zohar@linux.vnet.ibm.com> <1505507142.4200.103.camel@linux.vnet.ibm.com> <20170917151757.GA14262@infradead.org> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-MML: disable x-cbid: 17091716-0004-0000-0000-0000022F358A X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17091716-0005-0000-0000-00005E186F06 Message-Id: <1505664935.4200.191.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-09-17_10:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1709170235 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1945 Lines: 46 On Sun, 2017-09-17 at 08:28 -0700, Linus Torvalds wrote: > On Sun, Sep 17, 2017 at 8:17 AM, Christoph Hellwig wrote: > > > > Only for direct I/O, and IMA and direct I/O don't work together. > > From ima_collect_measurement: > > > > if (file->f_flags & O_DIRECT) { > > audit_cause = "failed(directio)"; > > result = -EACCES; > > goto out; > > } > > That's not the issue. > > The issue is that somebody else can come in - using direct IO - at the > same time as the first person is collecting measurements, and thus > race with the collector. > > So now the measurements are not trustworthy any more. Unless I'm missing something, that would only be possible with an IMA policy rule that permits direct IO (eg. permit_directio).  Otherwise the direct IO is denied. > > Well, that's exactly the point of the new ->integrity_read routine > > I proposed and prototype. The important thing is that it is called > > with i_rwsem held because code mugh higher in the chain already > > acquired it, but except for that it's entirely up to the file system. > > .. and *my* point is that it's the wrong lock for actually checking > integrity (it doesn't actually guarantee exclusion, even though in > practice it's almost always the case), and so we're adding a nasty > callback that in 99% of all cases is the same as the normal read, and > we *could* have just added it with a RWF flag instead. > > Is there some reason why integrity has to use that particular lock > that is so inconvenient for the filesystems it wants to check? Originally IMA had its own lock (iint->mutex), prior to IMA-appraisal being upstreamed.  With a separate lock, the iint->mutex and i_rwsem would be taken in reverse order in process_measurements() and in the setxattr, chown, chmod syscalls. I'm at the airport on my way back home. Mimi