Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935325AbeAOOsJ (ORCPT + 1 other); Mon, 15 Jan 2018 09:48:09 -0500 Received: from bombadil.infradead.org ([65.50.211.133]:60708 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934303AbeAOOsH (ORCPT ); Mon, 15 Jan 2018 09:48:07 -0500 Date: Mon, 15 Jan 2018 06:48:04 -0800 From: Christoph Hellwig To: Dongsu Park Cc: linux-kernel@vger.kernel.org, Alban Crequy , Miklos Szeredi , Mimi Zohar , Seth Forshee Subject: Re: [PATCH 0/2] turn on force option for FUSE in builtin policies Message-ID: <20180115144804.GA28856@infradead.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Thu, Jan 11, 2018 at 08:51:48PM +0100, Dongsu Park wrote: > In case of FUSE filesystem, cached integrity results in IMA could be > reused, when the userspace FUSE process has changed the > underlying files. To be able to avoid such cases, we need to turn on > the force option in builtin policies, for actions of measure and > appraise. Then integrity values become re-measured and re-appraised. > In that way, cached integrity results won't be used. The same is true for any distributed file system. Checking for magic numbers is always the wrong thing. You'll need flags for specific behavior in struct file_system_type instead.